CVE-2026-45087 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-45087 requires immediate attention.

· 6 min read

Executive Summary

URGENT: CVE-2026-45087 is a critical remote code execution flaw in github.com/hahwul/dalfox/v2 when Dalfox is run in server mode. In the default REST API configuration, the service binds to 0.0.0.0:6664 and does not require an API key unless explicitly configured. An unauthenticated attacker who can reach the port can submit a crafted scan request that causes Dalfox to execute an arbitrary shell command on the host.

This is especially dangerous for solo developers and small teams because the vulnerable setup is easy to overlook: a local test server can become a host compromise if exposed on a shared network, cloud VM, container, or port-forwarded environment.

Immediate Action

  • Stop exposing Dalfox server mode to untrusted networks immediately. If it is reachable on 0.0.0.0:6664, treat it as compromised until patched.
  • Shut down or isolate the service now. Bind to 127.0.0.1 only, or place it behind a firewall/VPN until you can upgrade.
  • Upgrade Dalfox to a fixed release as soon as one is available. If no fixed version is published yet, disable server mode entirely.
  • Do not rely on “it’s not exploited in the wild.” This issue is trivially reachable and weaponizable with a single HTTP request.
  • Review host integrity. Check for unexpected files, new users, cron jobs, startup entries, or outbound connections from the Dalfox host.
  • See vendor/project advisories here: TODO: vendor advisory / release notes.

Affected Versions

  • github.com/hahwul/dalfox/v2 in server mode is vulnerable when started without --api-key.
  • dalfox server with default REST settings is vulnerable if reachable over the network.
  • Safe versions: TODO: fixed version not yet confirmed. Upgrade to TODO: patched version or later once released.
  • Temporary safe state: running Dalfox only as a local, non-networked process with server mode disabled.

Resolution Guide

Best fix: upgrade to the first patched release. If you cannot upgrade immediately, apply the hardening steps below.

Go modules:

go get github.com/hahwul/dalfox/v2@TODO_FIXED_VERSION
go mod tidy
go test ./...

Docker:

docker pull TODO_DALFOX_IMAGE:TODO_FIXED_TAG
docker stop dalfox
docker rm dalfox
docker run --rm -p 127.0.0.1:6664:6664 TODO_DALFOX_IMAGE:TODO_FIXED_TAG

Hardening if you must keep server mode:

# Bind only to localhost
dalfox server --host 127.0.0.1 --port 6664 --type rest --api-key "$(openssl rand -hex 32)"

# Block network access at the firewall
ufw deny 6664/tcp
iptables -A INPUT -p tcp --dport 6664 -j DROP

Code fix example: require authentication and strip command-execution fields from API input.

// Reject unsafe startup
if serverType == "rest" && apiKey == "" {
    fmt.Fprintln(os.Stderr, "ERROR: --api-key is required in REST server mode")
    os.Exit(1)
}

// Strip execution-control fields from API requests
rq.Options.FoundAction = ""
rq.Options.FoundActionShell = ""

Package-manager notes: Dalfox is a Go module, so npm/yarn/pnpm, pip/pipx, Maven/Gradle, apt, and yum are generally not applicable unless you are wrapping Dalfox in another project. If you vendor it into a larger app, update the parent dependency to the patched Go module version.

Detection & Verification

Check whether you are exposed:

ss -lntp | grep 6664
ps aux | grep '[d]alfox server'
curl -s http://127.0.0.1:6664/health || true

Check your startup flags and config:

grep -RIn -- '--api-key\|dalfox server\|6664' .

Check the installed module version:

go list -m all | grep github.com/hahwul/dalfox/v2

Look for signs of abuse:

grep -RIn "found-action\|found-action-shell" .
find /tmp /var/tmp -maxdepth 1 -type f | head
journalctl -u dalfox --since "24 hours ago"

Verify the fix: after patching, an unauthenticated request to /scan should fail, and API-submitted found-action values should no longer execute. Confirm that the service only listens on 127.0.0.1 or is protected by a valid API key.

Risk and Impact

This vulnerability allows unauthenticated remote code execution on the host running Dalfox server mode. An attacker can read secrets, modify files, install persistence, and use the machine as a foothold for lateral movement. Because the default configuration is network-reachable and unauthenticated, the blast radius includes any exposed development box, CI runner, container host, or cloud VM running the service.

Keep reading