THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-2r5q-h53f-9rp3 (high) — @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

[GHSA] GHSA-2r5q-h53f-9rp3 (high) — @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

highgithub_advisoriesPublished 2026-09-09

GHSA-2r5q-h53f-9rp3 Severity: high CVE: CVE-2026-59160

@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

## Unauthenticated Network-Exposed Turborepo Task Execution via /api/run

### Summary

`@yeger/turbo-graph` starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces (`0.0.0.0:29312` by default).

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-59160cve
http://${hostname}:${options.port}`url
http://127.0.0.1:{PORT}/api/run?tasks=pwn&force=trueurl

Original source: https://github.com/advisories/GHSA-2r5q-h53f-9rp3