CVE-2026-124587

CVSS 4.3 (medium) · published 2026-11-09

A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue.

Weakness: CWE-200, CWE-284

Source: NVD CVE-2026-124587

References

• https://github.com/elizaOS/eliza/
• https://github.com/elizaOS/eliza/commit/cf6fa193017e70884e01c5bb7890f74b6b2b79d2
• https://github.com/elizaOS/eliza/issues/33034
• https://github.com/elizaOS/eliza/pull/33142
• https://vuldb.com/cve/CVE-2026-124587
• https://vuldb.com/submit/1039543
• https://vuldb.com/vuln/433011
• https://vuldb.com/vuln/433011/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.