CVE-2026-123499

Repository settings could redirect veans credentials

Vikunja · Vikunja veans coding-agent CLI

First documented disclosure · Review checkpoint

Summary

An untrusted checkout could select the destination for a developer’s Vikunja credentials.

Severity and exploitation evidence

Medium · 5.9/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The CLI accepted a repository-provided server address before establishing whether the user trusted that destination.

Conditions required

A developer or CI runner uses veans in an untrusted checkout with a token available, or supplies login credentials to the selected server.

Potential impact

The destination could receive a token or login material, with access dependent on those credentials.

Affected versions and configurations

Versions before 2.7.1 in the CNA record.

Fix and mitigation status

2.7.1, as listed by the project and CNA.

Practical next steps

Install the fix listed for 2.7.1 and revoke tokens or change credentials supplied in an affected checkout.

Operating lesson

Bind credential delivery to a trusted service origin independently of project configuration.

Evidence and limits

At disclosure veans had no separately tagged release. Both the maintainer’s advisory and the CNA identify 2.7.1 as patched.

Sources