CVE-2026-108372
7.1HighPublished 16 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
- Impact
- High impact on confidentiality
- Weakness
- CWE-346, CWE-942
Impact
Remote attackers can read local control-plane state, private Markdown files, and run configurations through cross-origin requests. They need a local operator running the status server to visit a malicious website.
Root cause
The status server sends overly permissive wildcard Access-Control-Allow-Origin headers on unauthenticated endpoints bound to predictable loopback ports.
Affected systems
LoopX 0.0.1 through 0.4.4
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade LoopX to version 0.4.5 or later. If updating immediately is not possible, stop running the `loopx serve-status` process.
$ pip install --upgrade 'loopx>=0.4.5'AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.