Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2026-22812 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Anoma Opencode. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified map to AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-22812 is a high-severity vulnerability (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) affecting OpenCode, an open source AI coding agent, in versions prior to 1.0.216. The issue stems from OpenCode automatically launching an unauthenticated HTTP server upon startup. This server exposes an endpoint that allows any local process, or any remote website via permissive CORS policies, to execute arbitrary shell commands with the privileges of the user running OpenCode. It is associated with CWEs 306 (Missing Authentication for Critical Function), 749 (Exposed Dangerous Method or Function), and 942 (Permissive Cross-domain Policy with Untrusted Domains).
The attack scenario requires low complexity and no attacker privileges but relies on user interaction (UI:R). A remote attacker can exploit it over the network by crafting a malicious website that, when visited by a victim running a vulnerable OpenCode instance, leverages the permissive CORS to send requests triggering shell command execution. Local processes on the victim's machine can also abuse the unauthenticated server directly. Successful exploitation grants the attacker remote code execution (RCE) at user level, enabling high-impact compromise of confidentiality, integrity, and availability, such as data theft, persistence, or further lateral movement.
The GitHub security advisory (GHSA-vxw4-wv6m-9hhh) confirms the vulnerability was fixed in OpenCode version 1.0.216. Security practitioners should upgrade to this version or later and review local network exposure of OpenCode instances, disabling or firewalled the HTTP server if not needed. Additional mitigation includes browser protections against cross-origin requests and user education on running AI coding agents.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2092
Vulnerability Data
OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability…
more
is fixed in 1.0.216.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 10 hardening rules · 5 OS baselines
V3.4.3V3.4.6V6.2.3V6.4.4
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates unique identification and authentication of users before access to functions requiring identity.
Extends the same authentication requirement to non-organizational users accessing critical functionality.
Requires authentication of services before they can invoke or expose critical functions.
Explicitly identifies and limits actions permitted without authentication, preventing critical functions from being exposed.
Access enforcement directly stops unauthorized callers from invoking dangerous API methods or functions.
Information flow enforcement requires approved authorizations and would reject policies permitting untrusted domains.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.
Enforcing least-privilege authorization directly prevents unrestricted dangerous API methods.
Hardened configuration baselines and reviews directly prevent permissive CSP or cross-domain policies.
Secure SDLC practices stop developers from exposing dangerous functions in the first place.
Vulnerability identification processes will surface exposed dangerous methods during assessment.
Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The control explicitly calls for authentication before any critical function is reached, eliminating the possibility of bypassing authentication for high-value operations.
Security testing can detect exposed dangerous functions, but does not prevent their initial introduction.
Mandating authentication requirements for critical functions at the requirements-gathering stage ensures that essential operations are not left unprotected by missing login or verification mechanisms.
Restricting privileged utility programs reduces exposure of dangerous functions, but does not eliminate the underlying weakness.
Privileged access rights limit who can invoke dangerous methods, but do not address whether the method itself should exist.
Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248585 OL 8 must require reauthentication when using the "sudo" command. prevents CWE-306
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-306
RHEL 7 (2 rules)
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-306
- V-237635 The Red Hat Enterprise Linux operating system must require re-authentication when using the "sudo" command. prevents CWE-306
RHEL 8 (2 rules)
- V-230492 RHEL 8 must not have the rsh-server package installed. prevents CWE-306
- V-237643 RHEL 8 must require re-authentication when using the "sudo" command. prevents CWE-306
Ubuntu 22.04 (3 rules)
- V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-749
- V-260529 Ubuntu 22.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. prevents CWE-749
- V-260557 Ubuntu 22.04 LTS must be configured to use AppArmor. prevents CWE-749
Ubuntu 24.04 (1 rule)
- V-270748 Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-749