CVE-2026-92992 in mayfly-go
Summary
by MITRE • 09/17/2026
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The identifier of the patch is 74bcb926eb4f5f94e7681144d7bf2168a0ec7cde. Applying a patch is the recommended action to fix this issue. The whitelist bypass is one-token wide. Any compound command containing curl, wget or sed auto-runs without approval; approval is granted by the same session user (self-approval). This issue got fixed with a silent patch.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The identified vulnerability in Dromara mayfly-go versions up to 1.11.5 represents a critical authentication and authorization failure within the AI Assistant component, specifically located in the server/internal/ai/api/ai.go file. This flaw allows for missing authorization checks that enable remote attackers to execute arbitrary commands without proper validation or approval workflows. The core of this security issue lies in how the system handles command execution requests submitted through its API interface. Instead of enforcing strict access controls and requiring explicit administrative consent, the application permits any session user to approve their own commands, effectively creating a self-approval mechanism that bypasses intended safety gates.
The technical nature of this vulnerability is best classified as an authorization bypass combined with unsafe command injection capabilities. The system implements a whitelist-based filtering mechanism designed to restrict dangerous operations, but this control is flawed due to its limited scope and lack of robust input validation. Specifically, the whitelist only covers one token width, meaning it fails to account for compound commands that chain multiple utilities together. When an attacker submits a request containing tools such as curl, wget, or sed within a single command string, the system's simplistic filtering logic does not recognize these as prohibited actions if they are part of a larger composite instruction. Consequently, these dangerous operations auto-run without requiring any external approval, allowing for unrestricted execution of shell commands under the context of the authenticated user session.
From an operational perspective, this vulnerability poses severe risks to data integrity and system availability. Because remote exploitation is possible, an attacker with valid credentials can leverage this flaw to execute arbitrary code on the host machine running mayfly-go. The ability to run curl or wget enables unauthorized data exfiltration by downloading malicious payloads from external servers or stealing sensitive configuration files. Similarly, the execution of sed allows for in-place modification of system files, which could lead to persistent backdoors, defacement, or disruption of services. Since the approval is granted by the same session user, there is no secondary verification step to catch malicious intent, making this a high-severity issue that can be exploited with minimal effort once initial access is obtained through compromised credentials.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) categories such as CWE-287 Improper Authentication and CWE-94 Command Injection: Uncontrolled Search Path Relative to Execution Context, or more specifically CWE-611 Improper Restriction of XML External Entity Reference if interpreted through input parsing failures, though the primary classification remains CWE-862 Missing Authorization. In terms of MITRE ATT&CK framework mapping, this behavior corresponds to T1059 Command and Scripting Interpreter, where an adversary uses system utilities like curl or sed to execute commands. The self-approval aspect also reflects aspects of privilege escalation within a single user context, bypassing intended administrative controls that should be present in enterprise-grade AI assistant tools.
The recommended mitigation is immediate application of the patch identified by commit hash 74bcb926eb4f5f94e7681144d7bf2168a0ec7cde. This silent patch addresses the root cause by strengthening the command filtering logic to properly handle compound commands and enforcing stricter authorization checks that prevent self-approval of dangerous operations. Organizations relying on mayfly-go for AI-assisted tasks must update their installations promptly to close this gap in access control. Additionally, implementing network-level restrictions such as web application firewalls can provide an additional layer of defense by blocking outbound connections from curl or wget if they originate from untrusted sources, although patching the underlying software remains the definitive solution.