CVE-2026-57443: 
Python vulnerability analysis and mitigation

CVE-2026-57443 is an unauthenticated information disclosure vulnerability in SCBE-AETHERMOORE, a geometric AI governance and evaluation framework. The AetherBrowser API server (scripts/aetherbrowser/api_server.py) exposes the POST /api/ops/check-email endpoint without any authentication, allowing any remote attacker to retrieve operator email metadata from configured ProtonMail or Gmail accounts. Affected versions are >= 4.0.2 and < 4.2.1 (pip package scbe-aethermoore); version 4.2.1 contains the patch. The vulnerability was first published by the maintainer on August 8, 2026, and added to the GitHub Advisory Database and NVD on September 25, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause is CWE-306 (Missing Authentication for Critical Function): the FastAPI route @app.post("/api/ops/check-email") in api_server.py (line 3008) is registered with no Depends() guard, middleware check, or API-key validation. When called, it invokes email_reader.py as a subprocess, which loads IMAP credentials from config/connector_oauth/.env.connector.oauth and connects to ProtonMail or Gmail, returning up to 2000 characters of stdout — including sender, subject, and body snippets — directly in the JSON response. Compounding the issue, the server binds to 0.0.0.0:8100 by default and CORS is configured with allow_origins=["*"], making the endpoint reachable from any network or browser origin with no preconditions. A public PoC (including a Dockerfile and poc.py script) is included in the security advisory itself (Github Advisory, Security Fix Commit).

An unauthenticated remote attacker who can reach port 8100 can exfiltrate operator email metadata — including sender addresses, email subjects, and body snippets — from the operator's ProtonMail or Gmail inbox without any credentials. Even without active mail credentials configured, the endpoint reveals which mail providers are integrated and leaks diagnostic output from internal tooling. Repeated calls also trigger repeated IMAP logins using stored credentials, which may generate account security alerts or exhaust connection limits. The vulnerability has no integrity or availability impact, but the confidentiality impact is rated High, affecting any cloud deployment or developer machine with port 8100 exposed (Github Advisory).

A detailed PoC — including a Dockerfile, a poc.py exploit script, and a manual curl command — is publicly available within the GitHub security advisory itself, making exploitation trivial for any attacker who can reach port 8100. No authentication, credentials, or prior knowledge of the application are required. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.0057 (~0.57%), indicating a currently low but non-negligible probability of exploitation. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Reconnaissance: Use Shodan, Censys, or similar tools to identify internet-facing hosts with port 8100 open, or scan internal networks for SCBE-AETHERMOORE deployments running versions >= 4.0.2 and < 4.2.1.
2. Confirm target: Send a GET request to http://<target>:8100/api/health to verify the AetherBrowser API server is running and responsive.
3. Send unauthenticated exploit request: Issue a POST request to the vulnerable endpoint with no authentication headers:

curl -s -X POST http://<target>:8100/api/ops/check-email \
  -H 'Content-Type: application/json' \
  -d '{}'

4. Receive email metadata: If mail credentials (PROTONMAIL_BRIDGE_PASSWORD or GMAIL_APP_PASSWORD) are configured, the JSON response will contain up to 2000 characters of email metadata including sender addresses, subjects, and body snippets. Without credentials, the response confirms the unauthenticated code path and reveals which mail providers are configured.
5. Enumerate further: Repeat calls to harvest additional email data or probe other unauthenticated /api/ops/* and /api/cli/* endpoints for additional information disclosure (Github Advisory).

• Network: Unexpected inbound HTTP POST requests to http://<host>:8100/api/ops/check-email from external or untrusted IP addresses; repeated connections to port 8100 from scanning tools or unfamiliar sources.
• Logs: Web server access logs showing "POST /api/ops/check-email HTTP/1.1" 200 responses to unauthenticated sources; absence of any 401 or 403 responses to requests on /api/ops/* endpoints (pre-patch).
• Process: Unexpected spawning of email_reader.py as a child process of the API server (api_server.py), particularly at unusual times or frequencies; IMAP connection attempts to ProtonMail Bridge or Gmail servers initiated by the server process.
• File System: Presence of config/connector_oauth/.env.connector.oauth containing IMAP credentials on systems where the AetherBrowser API server is internet-accessible (Github Advisory).

The primary remediation is to upgrade scbe-aethermoore to version 4.2.1 or later, which adds a fail-closed HTTP middleware (_guard_operator_endpoints) requiring a valid X-Admin-Token header matching the SCBE_OPS_ADMIN_TOKEN environment variable for all /api/ops/* and /api/cli/* routes (Security Fix Commit). As an immediate workaround prior to patching, restrict network access to port 8100 using firewall rules so only trusted hosts can reach the API server, and consider binding the server to 127.0.0.1 instead of 0.0.0.0. Additionally, restrict CORS to specific trusted origins rather than the wildcard allow_origins=["*"] setting (Github Advisory).

The vulnerability was discovered and reported by researcher min8282 via EQSTLab, and the advisory was published by the maintainer (issdandavis) on August 8, 2026. A Mastodon post from @thehackerwire noted the disclosure shortly after it was added to the NVD on September 25, 2026. No broader media coverage or significant community debate has been identified beyond standard vulnerability aggregator coverage (Github Advisory).