CVE-2026-59148: Unauthenticated Admin API Exposes Mockoon to Environment Variable Theft and Route Manipulation

Technical summary

The admin API endpoint (commons-server/src/libs/server/admin-api.ts) is mounted on the same Express listener as user-defined routes and serves CORS headers permitting all origins with write methods enabled. The endpoint implements no authentication checks (CWE-306), leaving it accessible to any unauthenticated caller with network access to the mock server port. The admin API exposes several attack vectors: the /mockoon-admin/env-vars endpoint allows arbitrary process environment variable manipulation, the PUT /mockoon-admin/environment method permits rewriting mock route bodies, status codes, and headers, and additional endpoints expose transaction logs and SSE streams. The permissive CORS configuration (Serve-Access-Control-Allow-Origin: *) combined with lack of CSRF tokens (CWE-352) and overly permissive file/resource permissions (CWE-732) compounds the risk. An attacker can read MOCKOON_* prefixed environment variables that may contain API keys, database credentials, or other sensitive configuration.

Business impact

For organizations using Mockoon in development or testing environments connected to shared networks or accessible via VPN, this vulnerability creates multiple operational risks. An attacker can extract credentials and secrets stored in environment variables, potentially leading to lateral movement into production systems or external service compromise. Malicious modification of mock routes can poison test data, invalidate test results, and delay software release cycles. In containerized or Kubernetes environments where mock servers may be accessed across pod networks, the blast radius expands significantly. Teams relying on Mockoon for API contract testing, CI/CD integration, or staging environments should treat this as a priority remediation item, particularly if the mock server runs on a network segment containing sensitive systems.

Affected systems

Mockoon versions prior to 9.7.0 are affected across all platforms and deployment contexts where the admin API is enabled by default. This includes shipped runtimes, containerized deployments, and local development environments. Any Mockoon instance accessible over the network—including those running in Docker, Kubernetes, or behind a reverse proxy—is vulnerable if not explicitly patched. Users running custom builds or forks should verify their version status against the canonical 9.7.0 release.

Exploitability

Exploitation requires only network access to the mock server port and no valid credentials. The attack can be executed using basic HTTP tools (curl, Postman, or browser fetch API) from any network-adjacent position. The CORS configuration and lack of authentication create a low barrier to entry; a single HTTP request can leak environment variables or modify mock routes. The CVSS score of 8.8 reflects the combination of high confidentiality impact (environment variable theft), high integrity impact (route manipulation), and high availability impact (purge/denial of service). While the CVSS vector includes a user interaction requirement (UI:R), this likely reflects the browser-based CORS constraint rather than a genuine user action—network-based tooling can bypass this. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, but the simplicity of exploitation and the severity of potential impact warrant immediate attention.

Remediation

Upgrade Mockoon to version 9.7.0 or later. This version disables or secures the admin API by default, removes the overly permissive CORS configuration, and implements authentication controls. For organizations unable to upgrade immediately, implement network-level controls: restrict inbound access to the mock server port to trusted hosts and subnets, isolate mock servers to separate network segments, disable the admin API if not required, and use environment variable injection patterns that avoid storing sensitive credentials directly in the process environment. Conduct an audit of Mockoon instances currently running in your environment to identify instances on shared or internet-facing networks.

Patch guidance

Update Mockoon to version 9.7.0 or later. Verify the version running in your environment using the application's version output or by checking package manifests in containerized deployments. For Docker-based deployments, rebuild container images using updated base images or package versions. For npm/node installations, run `npm update mockoon` or equivalent in your package manager. For CI/CD pipelines that use Mockoon, update the dependency specification in build configuration files to reference 9.7.0 or a later compatible version. After patching, verify that the admin API is no longer accessible without authentication and that CORS headers have been restricted.

Detection guidance

Search logs and network traffic for requests to paths beginning with /mockoon-admin/, particularly PUT requests to /mockoon-admin/environment or POST requests to /mockoon-admin/env-vars. Monitor for HTTP responses with Access-Control-Allow-Origin: * headers from mock server ports. Review audit logs for any unexpected changes to mock route definitions, environment variables, or transaction logs. In cloud environments, check CloudTrail or equivalent audit logs for API calls consistent with route or environment manipulation. Inspect process environment variables on Mockoon instances for sensitive data leakage—if a Mockoon process's environment has been dumped or exfiltrated, assume credential compromise. Enable request logging on mock server ports and alert on requests originating from unexpected sources.

Why prioritize this

This vulnerability merits immediate remediation because it combines ease of exploitation, lack of authentication, default-enabled exposure, and severe impact across confidentiality, integrity, and availability. Unlike vulnerabilities requiring authentication or user interaction, this can be exploited instantly by any network-adjacent attacker. The presence of admin APIs on the same network port as user-defined routes in a development/testing tool suggests a common misconfiguration pattern; organizations may have multiple Mockoon instances at risk. The potential for environment variable exfiltration creates a direct path to credential compromise. Although not yet documented as exploited in the wild, the straightforward attack vector and high-value targets (credentials, API definitions) make this a probable target for opportunistic attackers and a necessary precaution before the vulnerability is weaponized.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network-based attack vector, no authentication requirement, and high impact across all three security dimensions. Confidentiality is high due to exposure of environment variables and transaction logs. Integrity is high because attackers can rewrite mock routes, response bodies, and headers, poisoning data and system behavior. Availability is high because attackers can purge state and disrupt service. The user interaction flag (UI:R) in the vector likely accounts for browser-based CORS constraints, but this does not materially reduce risk for network-based tooling. The score appropriately captures the severity for typical mock server deployments in development and testing environments; organizations running Mockoon on internet-facing infrastructure without additional protections should treat this as critical.

Frequently asked questions