CVE-2026-40885: 
NixOS vulnerability analysis and mitigation

CVE-2026-40885 is a sensitive information disclosure vulnerability in goshs, a SimpleHTTPServer written in Go, that allows unauthenticated attackers to capture folder-level basic-auth credentials via the public collaborator WebSocket feed and replay them for unauthorized file access. It affects goshs versions 2.0.0-beta.4 through 2.0.0-beta.5, and was disclosed on April 13, 2026 by researcher R1ZZG0D via a GitHub Security Advisory. The vulnerability is fixed in version 2.0.0-beta.6. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory).

The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In goshs, the collaborator event pipeline logs and broadcasts raw HTTP request headers — including the Authorization header — via a public WebSocket endpoint (/?ws) before folder-level ACL enforcement is applied. Specifically, httpserver/handler.go calls emitCollabEvent() and logger.LogRequest() at lines 277–279 before applyCustomAuth() is invoked at lines 291–309, meaning credentials are broadcast to all WebSocket observers prior to any access control check. The WebSocket hub also replays up to 200 prior HTTP events to newly connected clients, extending the exposure window. The vulnerability only manifests when goshs is deployed without global basic auth (-b user:pass), as the main UI and collaborator WebSocket remain fully public in that configuration (GitHub Advisory).

An unauthenticated attacker who can connect to the goshs collaborator WebSocket can passively capture folder-specific Authorization: Basic headers from any victim request to a .goshs-protected directory. The attacker can then replay the captured credential to read, upload, overwrite, and delete files within the protected subtree — effectively achieving a full authentication bypass against ACL-protected content. Confidentiality, integrity, and availability of files in protected folders are all compromised. Deployments relying on per-folder .goshs ACLs without global authentication are directly and fully exposed (GitHub Advisory).

A detailed proof-of-concept (PoC) bash script and manual curl commands are publicly available in the GitHub Security Advisory, demonstrating the full attack chain from WebSocket observation through credential capture and replay. The advisory was published April 13, 2026, and the PoC has been confirmed to reproduce the vulnerability on v2.0.0-beta.5. There is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.068% (low probability of near-term exploitation). The vulnerability is not listed in the CISA KEV catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a publicly accessible goshs instance running version 2.0.0-beta.4 or 2.0.0-beta.5 without global basic auth enabled. Confirm the collaborator WebSocket is accessible at ws://<host>:<port>/?ws.
2. Connect as unauthenticated WebSocket observer: Open a WebSocket connection to the collaborator feed (e.g., using Node.js or wscat): const ws = new WebSocket('ws://TARGET:PORT/?ws'); ws.onmessage = (ev) => console.log(ev.data.toString());. The hub will also replay up to 200 prior HTTP events upon connection, potentially exposing historical credentials.
3. Wait for victim request: Monitor the WebSocket stream for messages containing an Authorization header from a victim accessing a .goshs-protected folder (e.g., Authorization":"Basic YWRtaW46YWRtaW4=).
4. Extract the credential: Parse the Base64-encoded credential from the broadcast event (e.g., using a regex: re.search(r'Basic [A-Za-z0-9+/=]+', text)).
5. Replay the captured credential: Use the leaked header to access protected resources: curl -H 'Authorization: Basic YWRtaW46YWRtaW4=' http://TARGET:PORT/ACLAuth/secret.txt (read), curl -H 'Authorization: Basic ...' -X PUT --data-binary 'owned' http://TARGET:PORT/ACLAuth/pwn.txt (write), or curl -H 'Authorization: Basic ...' 'http://TARGET:PORT/ACLAuth/secret.txt?delete' (delete).
6. Achieve full access: The replayed credential grants the same effective permissions as the original victim, enabling read, upload, overwrite, and deletion of all files within the protected subtree (GitHub Advisory).

• Network: Unexpected or repeated unauthenticated WebSocket connections to ws://<host>:<port>/?ws from unknown clients; HTTP requests to ACL-protected paths using Authorization: Basic headers from IP addresses that never previously authenticated directly.
• Logs: goshs access logs showing a sequence of: (1) an anonymous 401 request to a protected path, followed immediately by (2) a successful authenticated request from a different IP using the same credentials; multiple successful authenticated requests from IPs that have no prior login history.
• File System: Unexpected new files (e.g., pwn.txt) appearing in .goshs-protected directories; disappearance of files from protected directories without corresponding legitimate user activity; modification timestamps on protected files inconsistent with authorized user sessions.
• Process/Application: goshs server logs showing emitCollabEvent entries for requests to protected paths prior to ACL enforcement, indicating the vulnerable code path was triggered (GitHub Advisory).

Upgrade goshs to version 2.0.0-beta.6 or later, which fixes the credential leakage by ensuring sensitive headers are not broadcast via the collaborator WebSocket. As an immediate workaround for deployments that cannot upgrade, enable global basic authentication using the -b user:pass flag when starting goshs; this protects the collaborator WebSocket and main UI from unauthenticated access, preventing unauthorized observers from capturing credentials. Additionally, restrict network access to the goshs port to trusted clients only using firewall rules (GitHub Advisory).

The vulnerability was reported by researcher R1ZZG0D and published by project maintainer patrickhener via a GitHub Security Advisory on April 13, 2026. A brief write-up was published by Infinitsec covering the disclosure. No significant broader media coverage or notable community debate has been identified beyond standard CVE aggregator listings (GitHub Advisory).