CVE-2026-6874
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Apr 23, 2026
CISA due date
—
The record
A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token of the component Header Handler. Executing a manipulation of the argument Host can lead to reliance on reverse dns resolution. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | copilot-api | 0 | No fix |
Related vulnerabilities
- GHSA-3vr4-cvmg-7fx4 copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action Same vulnerability
- CVE-2026-55526 PraisonAI is a multi-agent teams system. CWE-350
- CVE-2026-46611 Glances is an open-source system cross-platform monitoring tool. CWE-350
- CVE-2026-12635 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before… CWE-350
- CVE-2026-36604 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the… CWE-350
- GHSA-fvh2-gm75-j4j7 dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport CWE-350
- CVE-2026-42559 RMCP is an official Rust SDK for the Model Context Protocol. CWE-350
- GHSA-xq94-r468-qwgj OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding CWE-350