Detections
Analytics

SCA: security update for github.com/m1k1o/neko/server (GHSA-2gw9-c2r2-f5qf)

high Tenable Self-Hosted Container Security Plugin ID 440696

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through
 3.0.10 and 3.1.0 through 3.1.1, any authenticated user can immediately obtain full administrative control
 of the entire Neko instance (member management, room settings, broadcast control, session termination,
 etc.). This results in a complete compromise of the instance. The vulnerability has been patched in
 v3.0.11 and v3.1.2. If upgrading is not immediately possible, the following mitigations can reduce risk:
 Restrict access to trusted users only (avoid granting accounts to untrusted parties); ensure all user
 passwords are strong and only shared with trusted individuals; run the instance only when needed; avoid
 leaving it continuously exposed; place the instance behind authentication layers such as a reverse proxy
 with additional access controls; disable or restrict access to the /api/profile endpoint if feasible;
 and/or monitor for suspicious privilege changes or unexpected administrative actions. Note that these are
 temporary mitigations and do not fully eliminate the vulnerability. Upgrading is strongly recommended.
 (CVE-2026-39386)

Solution

Update the github.com/m1k1o/neko/server library and its related packages to version 0.0.0-20260406184107-c54bcf1ee211 or later.

See Also

https://github.com/advisories/GHSA-2gw9-c2r2-f5qf

Plugin Details

Severity: High

ID: 440696

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 4/21/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-39386

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/21/2026

Vulnerability Publication Date: 4/21/2026

Reference Information

CVE: CVE-2026-39386