{"id":"CVE-2026-26057","aliases":["GHSA-ppfx-73j5-fhxc","PYSEC-2026-2415"],"url":"https://o3.security/vulnerability/CVE-2026-26057","summary":"Skill Scanner Unsecured Network Binding Vulnerability","details":"**Description:**\nA vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of service (DoS) condition or upload arbitrary files.\n\nThis vulnerability is due to an erroneous binding to multiple interfaces. An attacker could exploit this vulnerability by sending API requests to a device exposing the affected API Server. A successful exploit could allow the attacker to consume an excessive amount of resources (memory starvation) or to upload files to arbitrary folders on the affected device.\n\n**Conditions:**\nThis vulnerability affects Skill-scanner 1.0.1 and earlier releases when the API Server is enabled. The API Server is not enabled by default.\n\n**Fixed Software:**\nSkill-scanner software releases 1.0.2 and later contained the fix for this vulnerability.\n\n**For more information:**\nIf you have any questions or comments about this advisory:\n- [Open an issue in cisco-ai-defense/skill-scanner](https://github.com/cisco-ai-defense/skill-scanner/issues)\n- Email Cisco Open Source Security ([oss-security@cisco.com](mailto:oss-security@cisco.com)) and Cisco PSIRT ([psirt@cisco.com](mailto:psirt@cisco.com))\n\n**Credits:**\n\n- Research: Richard Tweed (@RichardoC)\n- Fix ideation and implementation: Richard Tweed (@RichardoC)\n- Release engineering: Vineeth Sai Narajala (@vineethsai7)","published":"2026-02-19T18:41:13.812Z","modified":"2026-08-12T03:51:21.875770897Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"cisco-ai-skill-scanner","fixedVersion":"1.0.2"}],"fix":{"url":"https://github.com/cisco-ai-defense/skill-scanner/commit/1e35e57f3051ecc89ba845ae7206321c8eac20a1","label":"cisco-ai-defense/skill-scanner@1e35e57"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26057.json"},{"type":"ADVISORY","url":"https://github.com/cisco-ai-defense/skill-scanner/security/advisories/GHSA-ppfx-73j5-fhxc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26057"},{"type":"FIX","url":"https://github.com/cisco-ai-defense/skill-scanner/commit/1e35e57f3051ecc89ba845ae7206321c8eac20a1"},{"type":"PACKAGE","url":"https://github.com/cisco-ai-defense/skill-scanner"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:21.875770897Z"}}