CVE-2026-39386

CVE-2026-39386 is a critical privilege escalation vulnerability affecting Neko, a self-hosted virtual browser application running in Docker. In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user can immediately gain full administrative control over the entire Neko instance, including member management, room settings, and session control. The vulnerability has been patched in versions 3.0.11 and 3.1.2, and users are strongly advised to upgrade immediately. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring only low complexity and low privileges, meaning any authenticated user can exploit it remotely without user interaction. The impact is severe, resulting in complete compromise of confidentiality, integrity, and availability of the affected instance. Temporary mitigations include restricting access to trusted users, enforcing strong passwords, implementing reverse proxy authentication, and disabling the vulnerable /api/profile endpoint, though these do not fully eliminate the risk. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed in the Known Exploited Vulnerabilities catalog and has inactive status on threat intelligence lists. The EPSS score of 0.00046 indicates minimal probability of exploitation, suggesting the vulnerability has received limited community attention relative to other disclosed vulnerabilities. Organizations running affected Neko versions should prioritize patching as a precaution despite low current exploitation activity.