Key points
- CVE-2026-108753 affects Agnaistic Agnai versions through 1.0.555.
- Attackers can log in as admin without authentication.
- The flaw exposes a fixed password and a public JWT secret.
Unauthenticated attackers can now seize full administrative control of Agnaistic Agnai installations running version 1.0.555 or earlier. The vulnerability, tracked as CVE-2026-108753, stems from hardcoded credentials embedded directly in the software’s deployment files. This allows remote attackers to bypass login screens entirely.
The flaw is rated Critical with a CVSS score of 9.3 by the National Vulnerability Database. It involves a fixed admin password and a publicly known JSON Web Token secret. These secrets reside in the self-host.docker-compose.yml file. Attackers use them to impersonate users and modify server settings without permission.
What we know
The National Vulnerability Database records CVE-2026-108753 as a high-severity issue affecting Agnaistic Agnai up to version 1.0.555. The weakness is classified under CWE-798, which covers use of hardcoded credentials. This means the sensitive data is baked into the code rather than being generated dynamically.
According to the NVD description, the self-host.docker-compose.yml file contains these static secrets. An unauthenticated attacker can simply use the fixed admin password to log in. Alternatively, they can sign their own JWT tokens using the public secret. This allows them to set the admin flag to true.
Once inside, attackers can reset user passwords and change server configurations. They can also impersonate any user on the system. The impact is total administrative takeover. No patch has been confirmed yet for this specific vulnerability in the source material. Users should treat exposed instances as compromised.
Defender's checklist
- Audit all Agnaistic Agnai installations for version 1.0.555 or lower.
- Check server logs for unauthorized admin logins or configuration changes.
- Verify if the self-host.docker-compose.yml file is accessible externally.
- Monitor for unusual JWT token activity or password reset requests.
What to do and how to stay safe: Agnaistic Agnai
- Isolate affected Agnaistic Agnai servers from the internet immediately.
- Rotate all user passwords and API keys on the affected system.
- Review server configurations for unauthorized changes made by attackers.
- Wait for the vendor to release an official update before reconnecting services.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-108753?
It is a critical vulnerability in Agnaistic Agnai through 1.0.555 that exposes hardcoded admin credentials and a public JWT secret.
How do attackers exploit this flaw?
Attackers use the fixed password to log in as admin or sign JWTs with admin privileges to impersonate users.
Is there a patch available?
No fix has been confirmed yet in the source material. Users should isolate affected systems until an update is provided.
