CVE-2026-57952: Mythic Authorization Bypass in C2 Profile Endpoints

Technical summary

CVE-2026-57952 is an authorization bypass vulnerability affecting Mythic versions prior to 3.4.0.60. Four REST API endpoints—c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, and c2profile_sample_message_webhook—fail to enforce ownership validation on payload UUIDs. This allows an authenticated operator to supply a known payload UUID from an unrelated operation and retrieve that operation's C2 profile configuration, including encryption keys, callback parameters, and related metadata. The vulnerability is classified as CWE-862 (Missing Authorization).

Business impact

In multi-tenant or shared Mythic deployments, this creates a lateral-access risk where one operator or team can extract sensitive command-and-control infrastructure details from another team's operations. Compromised encryption keys and callback parameters could enable an attacker to impersonate legitimate C2 traffic, intercept communications, or pivot to other infrastructure. For red teamers or penetration testers sharing a platform, this could expose client-sensitive data across engagements. The impact is heightened in environments where multiple security teams or contractors use the same Mythic instance.

Affected systems

All versions of Mythic prior to 3.4.0.60 are affected. The vulnerability is specific to the its-a-feature Mythic project. Deployments running version 3.4.0.60 or later are not affected. Verify your running version via the Mythic admin console or by querying the application endpoint.

Exploitability

Exploitation requires valid operator credentials and knowledge of (or ability to guess) a valid payload UUID from another operation. No unauthenticated access is possible, and no user interaction is required. The attack is network-based and could be automated. While the CVSS score of 5.3 reflects the requirement for valid credentials and the partial nature of the access (confidentiality impact only), the practical difficulty is relatively low once an operator account is compromised or if UUID enumeration is feasible. The vulnerability has not been designated for the CISA Known Exploited Vulnerabilities catalog.

Remediation

Update Mythic to version 3.4.0.60 or later. This patch enforces proper ownership validation on all four affected endpoints, ensuring that operators can only access C2 profiles associated with their own operation. Test the upgrade in a non-production environment first, as it may affect existing integrations or custom webhooks. After patching, audit logs to detect whether the vulnerability was exploited before the update.

Patch guidance

Upgrade to Mythic 3.4.0.60 or later. Verify the patch was successfully applied by confirming the version in the admin interface. If you maintain custom webhooks or integrations that call these four endpoints, review them post-patch to ensure they continue to function correctly. Consider implementing network-level access controls to restrict these endpoints to trusted IP ranges if they are exposed to the internet.

Detection guidance

Monitor API access logs for unusual patterns on the four affected endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook). Look for requests by one operator targeting payload UUIDs associated with other operations. Implement alerting on cross-operation C2 profile access or on failed authorization checks if your logging framework captures those events. Audit recent operator API calls and cross-reference the payloads accessed against operation ownership records.

Why prioritize this

Although the CVSS score is moderate (5.3), this vulnerability warrants priority for two reasons: first, in shared or multi-tenant Mythic deployments, it enables horizontal privilege escalation to extract infrastructure secrets; second, successful exploitation could lead to command-and-control traffic spoofing or further compromise of target systems. Organizations with active Mythic deployments should treat this as high priority for patching, particularly if the instance is accessible to multiple teams or contractors.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects the requirement for valid operator credentials (PR:L), the high confidentiality impact of exposing encryption keys and callback parameters (C:H), the lack of integrity or availability impact (I:N, A:N), and the somewhat high complexity of the attack (AC:H, likely due to UUID enumeration difficulty). However, in environments where operator credentials are frequently shared, delegated, or compromised, the practical risk is higher than the base score suggests.

Frequently asked questions