CVE-2026-108753: Agnaistic Agnai 1.0.555 docker-compose.yml Secrets Grant Remote Admin Access
A critical vulnerability in Agnaistic Agnai allows unauthenticated attackers to assume full administrative control using exposed credentials in deployment files.
Key points
- CVE-2026-108753 carries a CVSS score of 9.3, rated as critical severity by the National Vulnerability Database.
- The flaw affects Agnaistic Agnai versions up to and including 1.0.555 due to hardcoded secrets in docker-compose.yml.
- Attackers can reset passwords, modify server configurations, and impersonate any user without prior authentication.
The National Vulnerability Database published details for CVE-2026-108753 on a critical flaw in Agnaistic Agnai. The vulnerability exists in self-host.docker-compose.yml files for versions through 1.0.555. It involves hardcoded administrative credentials that are publicly accessible within the deployment configuration, creating an immediate risk for exposed instances.
How does the vulnerability function?
The Agnaistic Agnai application embeds a fixed admin password and a public JSON Web Token (JWT) secret within its self-host.docker-compose.yml file. According to the NVD record, this configuration error allows unauthenticated attackers to log in directly as an administrator.
Alternatively, attackers can use the exposed JWT secret to sign their own tokens. By setting the "admin" claim to true, they can impersonate users, bypass authentication checks, and gain full control over the application without needing valid user credentials.
What actions can attackers perform?
An unauthenticated attacker who exploits CVE-2026-108753 can reset user passwords and alter server configurations. The NVD description notes that the flaw enables impersonation of any user within the system. This allows for complete administrative takeover, data manipulation, and potential disruption of business operations relying on the platform.
Which versions are affected?
The vulnerability affects Agnaistic Agnai versions up to and including 1.0.555. The NVD record specifies that these versions contain the hardcoded credentials vulnerability. No patched version or fix has been confirmed in the provided source material. Organizations running these versions should assume their instances are vulnerable until a vendor update is issued.
What is the severity rating?
The National Vulnerability Database assigns a CVSS score of 9.3 to CVE-2026-108753. This places the vulnerability in the critical severity range. The weakness is classified under CWE-798, which covers use of hardcoded credentials. This high score reflects the ease of exploitation and the total loss of integrity and confidentiality it enables.
What to do and how to stay safe: Agnaistic Agnai
- Audit all self-host.docker-compose.yml files for hardcoded passwords or JWT secrets in Agnaistic Agnai deployments.
- Rotate all administrative passwords and user credentials immediately if exposed configurations are found.
- Monitor server logs for unauthorized administrative access or unexpected configuration changes.
- Isolate affected instances from public networks until the vendor provides a confirmed update.
Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch for CVE-2026-108753?
No patch or fix has been confirmed in the source material for Agnaistic Agnai versions through 1.0.555.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-108753 as 9.3, which is considered critical.
How do attackers exploit the hardcoded secrets?
Attackers use the fixed admin password or the public JWT secret to sign tokens with admin privileges.
