CVE-2026-7022
Published: 26 April 2026
Summary
CVE-2026-7022 is a medium-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-7 (Least Functionality).
Deeper analysis
CVE-2026-7022 is an improper authentication vulnerability (CWE-287) affecting SmythOS SRE versions up to 0.0.15. The issue resides in the AgentRuntime function within the file packages/core/src/subsystems/AgentManager/AgentRuntime.class.ts, part of the HTTP Header Handler component. It arises from manipulation of the X-DEBUG-RUN or X-DEBUG-INJ arguments in HTTP headers, enabling attackers to bypass authentication mechanisms. The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-04-26.
The vulnerability can be exploited remotely by unauthenticated attackers with no privileges required and low attack complexity, without needing user interaction. Successful exploitation grants limited access, potentially allowing low-impact disruptions to confidentiality, integrity, and availability, such as unauthorized debugging or injection via the manipulated headers.
Advisories from VulDB (vuldb.com/vuln/359601 and related pages) detail the issue, noting that an exploit has been publicly disclosed in a GitHub Gist (gist.github.com/YLChen-007/c6a4a6a5f4c8b9e758f72c07ca0cd30d) and may be actively used. The vendor was contacted early but provided no response, and no patches or mitigations are mentioned in the available references.
In context, this flaw targets an agent management subsystem in SmythOS, a platform for AI agent orchestration, highlighting risks in debug features exposed via HTTP headers; real-world exploitation is possible given the public PoC.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25697
Vulnerability details
A security vulnerability has been detected in SmythOS sre up to 0.0.15. Affected is the function AgentRuntime of the file packages/core/src/subsystems/AgentManager/AgentRuntime.class.ts of the component HTTP Header Handler. Such manipulation of the argument X-DEBUG-RUN/X-DEBUG-INJ leads to improper authentication. It is possible…
more
to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an improper authentication vulnerability in a public-facing HTTP header handler of SmythOS (a web-accessible AI agent platform), allowing remote unauthenticated attackers to bypass auth via X-DEBUG-RUN/X-DEBUG-INJ header manipulation. This directly enables the T1190 technique of exploiting public-facing applications for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources like AgentRuntime, directly preventing authentication bypass via manipulated X-DEBUG-RUN/X-DEBUG-INJ HTTP headers.
Validates HTTP header inputs to block manipulation of X-DEBUG-RUN or X-DEBUG-INJ arguments that trigger improper authentication in the AgentRuntime function.
Restricts the system to least functionality by prohibiting non-essential debug features exposed through HTTP headers in the AgentManager subsystem.