CVE-2026-63406: Information Disclosure via Insecure Telemetry and Hardcoded Credentials in AnyCable-Go

The vulnerability resides in the built-in telemetry subsystem of AnyCable-Go, a high-performance WebSocket server designed to scale real-time two-way communication in web applications. The telemetry component is responsible for gathering system statistics and server information to help developers monitor platform adoption. Under standard configurations before version 1.6.15, this subsystem was automatically activated upon application launch without administrative initialization.

This default enablement creates an unintended attack surface by transmitting environment metadata to a centralized public endpoint. Because telemetry ran continuously in the background, any deployment using default compilation flags began outbound transmissions immediately upon startup.

The core vulnerability belongs to two weakness classes: CWE-798 (Use of Hard-coded Credentials) and CWE-312 (Cleartext Storage of Sensitive Information). These flaws allow an unauthorized network observer to capture cryptographic data and reconstruct sensitive environment configurations through offline verification mechanisms.

The root cause of the vulnerability lies in the implementation of the telemetry client configurations and fingerprinting routines within the codebase. In telemetry/config.go, the authentication token used to validate telemetry streams with the central registry was defined as a hardcoded static string literal: var authToken = "secret". This static variable was loaded by default, meaning every standard deployment of the software compiled with these settings authenticated its network telemetry traffic using a public, globally identical credential.

Simultaneously, the server attempted to establish a unique but anonymous server identifier known as a cluster fingerprint. The function clusterFingerprint() in telemetry/telemetry.go processed the server configuration along with the raw command-line arguments returned by the system runtime. If an administrator supplied security-critical options on the command line, such as --secret, --jwt_secret, or --http_rpc_secret, these raw command-line strings were included in the configuration structure.

The gathered configuration structure was then directly serialized and passed to a deterministic SHA-256 hashing routine. The resulting hexadecimal hash served as the stable cluster fingerprint. Because the hashing process did not apply a cryptographically secure random salt, the generated output was completely deterministic.

Analyzing the code changes between version 1.6.14 and 1.6.15 shows how the insecure configuration defaults were addressed. The patch changed how the tracker is instantiated and removed the static default authentication token.

Below is the comparison of the configuration initiation in telemetry/config.go before and after the patch:

// VULNERABLE: telemetry/config.go (Pre-1.6.15)
var authToken = "secret" // make it overridable during build time
 
func NewConfig() *Config {
    return &Config{
        Token:       authToken,
        Endpoint:    "https://telemetry.anycable.io",
        Debug:       os.Getenv("ANYCABLE_TELEMETRY_DEBUG") == "1",
        CustomProps: map[string]string{},
    }
}

// PATCHED: telemetry/config.go (Version 1.6.15)
var auth = "" // provide a secret token during the build time to enable tracking
 
func NewConfig() *Config {
    return &Config{
        Token:       auth,
        Endpoint:    "https://telemetry.anycable.io",
        Debug:       os.Getenv("ANYCABLE_TELEMETRY_DEBUG") == "1",
        CustomProps: map[string]string{},
    }
}

By changing the global variable from authToken = "secret" to auth = "", the telemetry engine defaults to an empty token. In telemetry/telemetry.go, the initialization function checks if this token is empty and disables telemetry collection if no token is found:

// PATCHED: telemetry/telemetry.go (Version 1.6.15)
func NewTracker(instrumenter *metrics.Metrics, c *config.Config, tc *Config) *Tracker {
    if tc.Token == "" {
        return &Tracker{} // Returns unenabled tracker
    } 
    // ... setup and generate cluster fingerprint ...
}

An attack against this vulnerability does not rely on sending a malicious payload to the target server. Instead, it relies on passive network interception followed by an offline cryptanalysis phase. An adversary must first capture the telemetry transmission on the network path between the target server and the collection host.

The following sequence diagram outlines the complete attack flow:

Because the fingerprint is generated using a deterministic SHA-256 hashing algorithm over known patterns, the attacker can reconstruct the hash locally. By targeting common dictionary terms and predictable formats (such as --jwt_secret=value), the attacker can quickly compare hashes to find a match and reveal the administrative credentials.

The security impact of CVE-2026-63406 is primarily centered on the compromise of system confidentiality. Successfully extracting administrative secrets allows the attacker to compromise the integrity and availability of the wider application.

If an attacker cracks the jwt_secret or secret variables, they gain the ability to forge valid signatures. This allows them to create custom JSON Web Tokens (JWT) or signed session cookies, facilitating complete authentication bypass. The attacker can then connect to any active WebSocket channel as a highly privileged administrator or impersonate other users on the platform.

The Common Vulnerability Scoring System (CVSS) assigned a base score of 5.9 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The attack complexity is rated as high because exploitation requires a network interception position and a subsequent offline brute-force phase.

The primary resolution is to upgrade all AnyCable deployments to version 1.6.15 or later. In this version, telemetry is disabled by default because the compiler variable auth is empty.

For deployments where immediate upgrading is not feasible, administrators can apply network-level mitigations. Blocking outgoing traffic from AnyCable servers to the default endpoint telemetry.anycable.io on port 443 prevents the transmission of fingerprint hashes.

Alternatively, administrators should transition sensitive configurations away from command-line arguments. Passing parameters like --secret or --jwt_secret via environment variables (such as ANYCABLE_SECRET or ANYCABLE_JWT_SECRET) instead of CLI arguments prevents them from being parsed into the os.Args array, excluding them from the telemetry fingerprint calculation.