Secuno
ENNL
Book demo

CVE-2026-22812

Anoma Opencode authentication bypass

8.8 HIGHPublic exploitEPSS 16.5%
  1. Published12 Jan 2026

Description

OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Anoma Opencode< 1.0.216

Remediation

Fixed in
Anoma Opencode≥ 1.0.216

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-891109.9
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in…
CVE-2026-876899.8
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store…
CVE-2026-843138.8
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST…
CVE-2026-1095568.0
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability…
CVE-2026-1095759.8
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition…
CVE-2026-1094228.1
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and…

Frequently asked

Is CVE-2026-22812 being actively exploited?

CVE-2026-22812 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 16.5%.

How severe is CVE-2026-22812?

CVE-2026-22812 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 16.5% probability of exploitation.

Which products are affected by CVE-2026-22812?

Affected products include Anoma Opencode.

How do I fix CVE-2026-22812?

Upgrade affected software to a fixed version, for example Anoma Opencode 1.0.216 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-22812 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.