CVE-2026-109823
Host filesystem path disclosure via DNS rebinding
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout. This issue affects tidewave: from 0.8.0 before 0.9.2.
| CWE | CWE-497 |
| Vendor | tidewave-ai |
| Product | tidewave |
| Published | Oct 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for tidewave-ai tidewave
Be the first to know when new unknown vulnerabilities affecting tidewave-ai tidewave are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
tidewave-ai / tidewave
0.8.0 < 0.9.2
tidewave-ai / tidewave
f78352b56d19cd4ae49999aa385011cef73e8b93 < 80159536f752dc4d34797934d1516f29cea12b50
References
cna.erlef.org: https://cna.erlef.org/cves/CVE-2026-109823.html osv.dev: https://osv.dev/vulnerability/EEF-CVE-2026-109823 github.com: https://github.com/tidewave-ai/tidewave_phoenix/commit/f78352b56d19cd4ae49999aa385011cef73e8b93 github.com: https://github.com/tidewave-ai/tidewave_phoenix/commit/80159536f752dc4d34797934d1516f29cea12b50
Credits
Neil Berkman 🔍 Neil Berkman Jonatan Männchen / EEF