CVE-2026-13140

Vulnerability Description

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

Related Weaknesses (CWE)

CWE-79

References

https://github.com/thinkst/canarytokens/security/advisories/GHSA-23pf-xjp2-48q6

FAQ

What is CVE-2026-13140?

CVE-2026-13140 is a documented vulnerability. Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. This issue affects Cana...

How severe is CVE-2026-13140?

CVSS scoring is not yet available for CVE-2026-13140. Check NVD for updates.

Is there a patch for CVE-2026-13140?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.