Is CVE-2026-45728 actively exploited?

No active exploitation of CVE-2026-45728 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-45728 be exploited remotely?

Yes. CVE-2026-45728 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-45728?

CVE-2026-45728 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-45728

HIGH

CVE-2026-45728

CWE-209Published: May 26, 2026· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, which on any Lua or template error response dumps the absolute path of the file that errored, complete byte contents of that file, and exception or parser error text. This response is served with HTTP 200 OK to whoever sent the request that triggered the error. Any client able to reach the server and able to provoke a runtime error in the served script obtains the full server-side source of that script and of any sibling Lua data file consulted during the request. This vulnerability is fixed in 1.17.7.

NVD Source

Technical Analysis

CVE-2026-45728 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.