CVE-2026-14611: DeepMyst Mysti Authentication Information Disclosure Vulnerability

Technical summary

CVE-2026-14611 affects the initProjectMemory function in src/managers/MemoryManager.ts within DeepMyst Mysti's Per-Project Auto-Memory Handler component. The vulnerability stems from insufficient validation of the workspacePath parameter, enabling an authenticated remote attacker to traverse or access unintended resource paths. The flaw is classified under CWE-200 (Exposure of Sensitive Information) and CWE-668 (Exposure of Resource to Wrong Sphere), indicating both information disclosure and improper resource boundary enforcement. The CVSS v3.1 score of 4.3 reflects a medium-severity issue with network-based attack vector, low attack complexity, and requirement for authenticated access.

Business impact

This vulnerability poses a moderate confidentiality risk to organizations running vulnerable versions of DeepMyst Mysti. An authenticated user—whether internal or with compromised credentials—could access project memory or workspace data not intended for their role, potentially exposing proprietary analysis, model configurations, or sensitive project metadata. The attack does not compromise integrity or availability, but unauthorized information disclosure in development or analytics workflows can breach data governance policies and create compliance liabilities.

Affected systems

DeepMyst Mysti versions 0.4.0 and earlier are affected. Organizations should verify their deployed version against release notes. The component in scope is the Per-Project Auto-Memory Handler, which manages workspace-scoped memory contexts.

Exploitability

Exploitation requires valid authentication credentials and network connectivity to the Mysti instance. No special privileges or user interaction is needed once authenticated. The low attack complexity and absence of any user-click requirement make exploitation straightforward for an attacker with legitimate or stolen credentials. The vulnerability is not known to be actively exploited in the wild (not on the CISA KEV catalog), but the ease of weaponization warrants prompt patching.

Remediation

Upgrade DeepMyst Mysti to version 0.4.0 or later. The fix is included in patch commit 6d709229b5199f6769fb3cf763e5122dcc43c079. Verify the patch hash against the official DeepMyst release notes to confirm authenticity. No workarounds are documented; patching is the only remediation.

Patch guidance

Apply the available update to version 0.4.0 immediately. Before deployment, test the patched version in a non-production environment to ensure no regression in memory handler functionality or workspace isolation behavior. Coordinate the upgrade across all instances of Mysti in your environment to prevent lateral movement via unpatched nodes. Consult the vendor's release notes for any configuration changes or data migration steps.

Detection guidance

Monitor authentication logs for unusual access patterns by service accounts or users accessing multiple workspaces in short timeframes. Review application logs for errors or warnings originating from the MemoryManager component. If available, enable verbose logging on workspace path resolution to detect suspicious path traversal attempts. A SIEM rule correlating multiple failed or successful memory initialization calls with anomalous workspacePath values may surface exploitation attempts. Post-patch, baseline normal behavior and alert on deviations.

Why prioritize this

Although the CVSS score is moderate (4.3), the vulnerability should be addressed within your standard patching cycle—typically within 30 days for medium-severity flaws affecting authenticated services. Prioritize higher if your Mysti instance handles sensitive project data, processes competitive research, or runs in a high-trust environment where user compromise is a realistic threat model. The simplicity of exploitation and lack of required privileges once authenticated make this a non-negligible risk.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects the network attack vector, low complexity, and requirement for authentication. Confidentiality impact is low (user can read some resources they shouldn't), but integrity and availability are unaffected. In your environment, elevation to high risk may be warranted if: (1) Mysti processes highly sensitive or proprietary data; (2) user account compromise is frequent; or (3) inter-user data isolation is a critical security boundary.

Frequently asked questions