CVE-2026-45577

Executive Summary

CVE-2026-45577 is an authentication bypass vulnerability in Neotoma, a tool that provides versioned records persisting across agent runs. Affecting versions from 0.6.0 to before 0.11.1, the flaw allows unauthenticated remote attackers to bypass REST API authentication when the application is deployed behind a reverse proxy. Specifically, if a request arrives over a loopback socket (127.0.0.1) without a Bearer token, the middleware incorrectly treats it as a local development user request, exposing the Inspector and related API surface without credentials. This can lead to unauthorized access to sensitive versioned records and potential data leakage. The vulnerability is fixed in version 0.11.1.

Supply Chain & Package Security

Neotoma is a Python package available via PyPI. Users should verify their installed version and update to 0.11.1 or later. The package is not directly affected by dependency confusion or typosquatting, but the authentication bypass introduces a critical supply chain risk if deployed in production environments with public reverse proxies.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full access to versioned records.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 7.5 (High) – Unauthenticated remote access to sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the REST auth middleware of Neotoma. When a request is received over a loopback socket (e.g., from a reverse proxy like Nginx or Apache forwarding traffic to 127.0.0.1), the middleware checks for a Bearer token. If no token is present, it defaults to treating the request as coming from the local development user, bypassing authentication entirely. This occurs because the middleware incorrectly assumes that loopback traffic is inherently trusted.

In a typical deployment, a reverse proxy handles external requests and forwards them to Neotoma on localhost. The middleware should require a Bearer token for all requests, but the flawed logic allows unauthenticated requests to pass through if they arrive on the loopback interface. Attackers can exploit this by sending requests directly to the Neotoma service (if exposed) or by manipulating the reverse proxy to forward requests without authentication headers.

The fix in version 0.11.1 ensures that all requests, regardless of source interface, require a valid Bearer token. The patch modifies the middleware to reject any request without a token, even if it arrives over loopback.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

# auth_middleware.py (vulnerable)
def authenticate(request):
    if request.source_ip == '127.0.0.1':
        # Trust loopback traffic
        request.user = LOCAL_DEV_USER
        return True
    token = request.headers.get('Authorization')
    if token and validate_token(token):
        request.user = get_user_from_token(token)
        return True
    return False

Patched Code (0.11.1):

# auth_middleware.py (patched)
def authenticate(request):
    token = request.headers.get('Authorization')
    if token and validate_token(token):
        request.user = get_user_from_token(token)
        return True
    # Reject all unauthenticated requests
    return False

The patched version removes the special handling for loopback traffic, requiring authentication for all requests.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Neotoma 0.6.0 on a server with a reverse proxy (e.g., Nginx) forwarding to localhost:8080.
2. Ensure the reverse proxy does not add authentication headers.
3. From an external machine, send a request to the Neotoma Inspector endpoint without a Bearer token.

Exploitation Steps:

# Direct request to Neotoma Inspector (if exposed)
curl http://target:8080/inspector

# Request via reverse proxy (no auth header)
curl http://target/inspector

Expected Result: The request is authenticated as the local development user, granting access to the Inspector and API.

Blue Team

Detection:

• Monitor for requests to Neotoma endpoints without Authorization headers.
• Alert on access to /inspector or other sensitive API paths from external IPs.
• Check logs for authentication bypass events (e.g., user set to LOCAL_DEV_USER).

Hunting:

• Search for requests with source_ip of 127.0.0.1 but originating from external networks (via reverse proxy logs).
• Correlate reverse proxy logs with Neotoma application logs to identify mismatches.

Indicators of Compromise (IOCs)

• Network: HTTP requests to Neotoma endpoints (e.g., /inspector, /api/) without Authorization header.
• Logs: Neotoma logs showing user=LOCAL_DEV_USER for requests from external IPs.
• File: Unauthorized access to versioned records in Neotoma storage.
• Behavior: Sudden increase in requests to Neotoma from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2026_45577_Neotoma_AuthBypass {
    meta:
        description = "Detects Neotoma authentication bypass attempts"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-45577"
    strings:
        $auth_bypass = "LOCAL_DEV_USER" nocase
        $inspector = "/inspector" nocase
    condition:
        $auth_bypass or $inspector
}

Sigma Rule

title: Neotoma Authentication Bypass Detection
id: cve-2026-45577
status: experimental
description: Detects unauthenticated access to Neotoma Inspector
author: Valters IT
logsource:
    category: webserver
    product: neotoma
detection:
    selection:
        cs-uri-query|contains: '/inspector'
        cs-method: 'GET'
        cs-auth-token: ''  # No Authorization header
    condition: selection
falsepositives:
    - Legitimate local development access
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-45577 Neotoma Authentication Bypass"; flow:to_server; content:"/inspector"; http_uri; nocase; pcre:"/^Authorization\s*:\s*$/mi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Neotoma to version 0.11.1 or later.
• If upgrade is not possible, configure the reverse proxy to require authentication before forwarding requests to Neotoma.

Long-term:

• Implement network segmentation to restrict access to Neotoma services.
• Use API gateways with mandatory authentication.
• Regularly audit dependencies for known vulnerabilities.

Workaround:

• Add a firewall rule to block external access to Neotoma ports.
• Modify the reverse proxy to inject a Bearer token for all forwarded requests.

Valters IT
Securing Digital Frontiers