CVE Intelligence
Analysis AI-assisted

CVE-2026-26057: Skill Scanner Unsecured Network Binding Vulnerability

CVE-2026-26057 affects the API Server of Skill Scanner, a scanner for AI Agent Skills, because it binds to multiple network interfaces. According to the record, an unauthenticated remote attacker could cause denial of service or write files to arbitrary folders, with NVD scoring it 9.1 (Critical) under CVSS 3.1. The record states that versions 1.0.1 and earlier are affected only when the API Server is enabled, and that version 1.0.2 and later contain the fix.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an erroneous binding of the Skill Scanner API Server to multiple network interfaces, classified as CWE-668 (Exposure of Resource to Wrong Sphere). The API Server is described as not enabled by default.

Impact

  • According to the record, an unauthenticated remote attacker could interact with the API and cause a denial of service through excessive resource consumption (memory starvation).
  • The record also states that the attacker could upload files to arbitrary folders on the affected device.
  • NVD scores the issue 9.1 (Critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. GitHub scores it 6.5 under CVSS 3.1.

Affected products and versions

  • Cisco Skill Scanner, versions before 1.0.2, as listed in the record.
  • Cisco-ai-defense Skill-scanner, versions before 1.0.2, as listed in the record.
  • The record states that version 1.0.1 and earlier releases are affected when the API Server is enabled.
  • Version 1.0.2 and later contain the fix according to the record and the vendor advisory.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation appears in the sources consulted. SSVC lists exploitation as none, and the EPSS probability in the record is 0.00497 (percentile 0.41765).

Remediation and mitigation

  • Upgrade Skill Scanner to version 1.0.2 or later, as the vendor advisory and patch commit indicate.
  • If the API Server is not needed, keep it disabled, since the record says it is not enabled by default.
  • If the API Server must run, restrict network exposure so that it is reachable only from trusted hosts and networks, and place it behind access controls.
  • Review whether any deployment has exposed the API Server to untrusted networks.

Detection guidance

  • Identify installations of Skill Scanner and record their versions and whether the API Server is enabled.
  • Review network configuration to find hosts where the API Server listens on interfaces reachable from outside the intended trust boundary.
  • Monitor for unexpected resource exhaustion on hosts running the API Server and for unexpected file creation in directories used by the service.

Limitations of the available information

  • The record does not describe the specific API endpoints, the exact conditions for file placement, or any public proof of concept.
  • The record does not state the number of affected installations or the scope of exposure in real environments.
  • The EPSS date in the record is later than the publication date; the score should be treated as provided by the data source without further interpretation.
  • Scoring differs between NVD (9.1) and GitHub (6.5); the sources consulted do not explain the difference.

Frequently asked questions

Is CVE-2026-26057 actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

Which Skill Scanner versions are affected?

The record lists versions before 1.0.2 and states that version 1.0.1 and earlier are affected when the API Server is enabled.

Is the API Server enabled by default?

No, according to the record the API Server is not enabled by default.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.