Is CVE-2026-46431 actively exploited?

No active exploitation of CVE-2026-46431 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-46431 be exploited remotely?

Yes. CVE-2026-46431 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-46431?

CVE-2026-46431 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-46431

MEDIUM

CVE-2026-46431

CWE-942Published: May 26, 2026· Updated: May 26, 2026

4.3

CVSS v3.1

Official Description

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard * regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient to let any third-party page the developer visits open a cross-origin EventSource to the SSE port and read the live filename stream from JavaScript. This vulnerability is fixed in 1.17.7.

NVD Source

Technical Analysis

CVE-2026-46431 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.