CVE-2026-111823

9.8Critical

Published 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-390

Impact

Unauthenticated remote attackers can bypass authentication and create unauthorized sessions via network access. This grants full access to the Mage OSS instance without valid credentials.

Root cause

The authentication logic fails to abort session creation when handling an unknown OAuth provider, allowing execution to proceed unchecked.

Affected systems

Mage OSS through 0.9.80 (specifically commits before 76c4f46)

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a Mage OSS release containing commit 76c4f46 or later. If upgrading is delayed, restrict network access to the Mage OSS web interface to trusted IPs only.

shell

$ pip install --upgrade mage-ai

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111823