# CVE-2026-63406: AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

> CVE-2026-63406 (GitHub advisory GHSA-w72w-9qmj-c9qm) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.9, classed as Cleartext Storage of Sensitive Information (CWE-312), in github.com/anycable/anycable (Go). Affected versions: <= 1.6.14. It is fixed in 1.6.15.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-63406

| Field | Value |
| --- | --- |
| CVE | CVE-2026-63406 |
| GHSA | GHSA-w72w-9qmj-c9qm |
| Severity | Medium |
| CVSS 3.1 | 5.9 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` (GitHub Advisory Database) |
| CWE | CWE-312 Cleartext Storage of Sensitive Information; CWE-798 Use of Hard-coded Credentials |
| EPSS | 0.24% (higher than 16% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation poc, automatable no, technical impact partial |
| Published | 18 Sept 2026 |
| Modified | 18 Sept 2026 |

## Description

The telemetry subsystem embeds a hardcoded auth token (`"secret"`) in the public source and transmits raw CLI arguments—including `--secret`, `--jwt_secret`, and `--http_rpc_secret` values—to a third-party telemetry endpoint.

##### Details
In `telemetry/config.go` line 12, `var authToken = "secret"` is committed in the public repository and used to authenticate to `https://telemetry.anycable.io`. In `telemetry/telemetry.go`, `clusterFingerprint()` (line 320) calls both `anycableFileConfig(c.ConfigFilePath)` (line 333), which reads the full TOML config file contents, and `anycableCLIArgs()` (line 402), which reads `os.Args[1:]` verbatim—including any `--secret=...`, `--jwt_secret=...`, `--http_rpc_secret=...` arguments. Both raw values are passed to `generateDigest()` (line 373), meaning the actual secret strings flow through the code path and are included in telemetry data sent to the third-party server. Since the hardcoded `authToken = "secret"` is public, any attacker who can perform DNS hijacking or is positioned on the network path can intercept and read the telemetry payload containing operator credentials.

##### PoC
1. Read `telemetry/config.go` in the public repo to find `authToken = "secret"`.
2. Set up a DNS spoof for `telemetry.anycable.io` pointing to an attacker-controlled server.
3. Start anycable-go with `--secret=my-production-secret`.
4. The server sends a POST to the attacker's endpoint with the telemetry JSON payload. The `clusterFingerprint` field contains data derived from raw `os.Args` including `--secret=my-production-secret`.

##### Impact
In MITM/DNS-hijack scenarios, production secrets (JWT secrets, broadcast keys, RPC auth) are exposed to third parties. The hardcoded `authToken = "secret"` provides no protection since it is known to anyone reading the open-source code.

##### Fix
1. Remove the hardcoded `authToken` from source; generate or require operator configuration at build time or deployment time. 2. Remove `anycableCLIArgs()` from the fingerprint computation, or sanitize it to exclude values of secret-bearing flags before hashing. 3. Add a documented opt-out mechanism for telemetry.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| github.com/anycable/anycable | Go | `pkg:golang/github.com/anycable/anycable` | <= 1.6.14 | 1.6.15 |

## Fix commits

- Patch: https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee
- Release: https://github.com/anycable/anycable/commit/6e7591c009e53186b64ab013d10ab26aac9e7899 (1.6.15)

## Questions

**What is the GHSA ID for CVE-2026-63406?**

GitHub tracks CVE-2026-63406 as GHSA-w72w-9qmj-c9qm.

**What is the CVSS score of CVE-2026-63406?**

CVE-2026-63406 has a CVSS 3.1 base score of 5.9 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

**Which versions are affected by CVE-2026-63406?**

github.com/anycable/anycable (Go): <= 1.6.14.

**How do I fix CVE-2026-63406?**

Upgrade to 1.6.15 or later. The fix is in commit 201c67e.

**What is the Package URL (PURL) for CVE-2026-63406?**

The affected package's PURL is pkg:golang/github.com/anycable/anycable.

**Is CVE-2026-63406 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-63406. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 16% of CVEs.

## References

- https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee (fix)
- https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63406.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2026-63406 (advisory)
- https://github.com/advisories/GHSA-w72w-9qmj-c9qm (advisory)
- https://github.com/anycable/anycable (package)
- https://github.com/anycable/anycable/releases/tag/v1.6.15

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-63406), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.