[GH-ISSUE #1781] (UPSTREAM) MeshCentral Security Vunlerability when version <1.1.20 #1110

New issue

Closed

opened 2026-03-02 02:21:13 +03:00 by kerem · 2 comments

kerem commented

2026-03-02 02:21:13 +03:00

Owner

Originally created by @LPJon on GitHub (Mar 4, 2024).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/1781

@wh1te909 Just reporting to make you aware that there has been a securty vulnerability reported for Meshcentral servers which are less than version 1.1.20. The link below will take you to the vulnerability explanation. I will note that I successfully manually updated Meshcentral myself to version 1.1.21 already but most users probably won't do that.

Here is the link:
MeshCentral cross-site websocket hijacking (CSWSH) vulnerability

A possible breach has already been detected a few days ago and that link can be found here:
"Accepted password for undefined" #5870

Originally created by @LPJon on GitHub (Mar 4, 2024). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/1781 @wh1te909 Just reporting to make you aware that there has been a securty vulnerability reported for Meshcentral servers which are less than version 1.1.20. The link below will take you to the vulnerability explanation. I will note that I successfully manually updated Meshcentral myself to version 1.1.21 already but most users probably won't do that. Here is the link: [MeshCentral cross-site websocket hijacking (CSWSH) vulnerability](https://github.com/Ylianst/MeshCentral/security/advisories/GHSA-cp68-qrhr-g9h8) A possible breach has already been detected a few days ago and that link can be found here: [ "Accepted password for undefined" #5870 ](https://github.com/Ylianst/MeshCentral/issues/5870)

kerem closed this issue

2026-03-02 02:21:13 +03:00

kerem commented

2026-03-02 02:21:14 +03:00

Author

Owner

@wh1te909 commented on GitHub (Mar 4, 2024):

I am aware, and this isn't the place to report security vulns, please see our security policy I have already tested mesh version 1.1.21 and it will be in the next release. The mesh security vuln is not easily exploitable (requires the attacker to hijack a subdomain you own). The issue you linked about undefined user has nothing to do with the mesh vuln.

@wh1te909 commented on GitHub (Mar 4, 2024): I am aware, and this isn't the place to report security vulns, please see our [security policy](https://github.com/amidaware/tacticalrmm/blob/develop/SECURITY.md) I have already tested mesh version 1.1.21 and it will be in the next release. The mesh security vuln is not easily exploitable (requires the attacker to hijack a subdomain you own). The issue you linked about undefined user has nothing to do with the mesh vuln.

kerem commented

2026-03-02 02:21:14 +03:00

Author

Owner

@LPJon commented on GitHub (Mar 4, 2024):

@wh1te909 Umm.....that was my bad. Sorry for incorrectly reporting this. I was in a hurry and didn't look.

@LPJon commented on GitHub (Mar 4, 2024): @wh1te909 Umm.....that was my bad. Sorry for incorrectly reporting this. I was in a hurry and didn't look.

kerem referenced this issue

2026-03-14 04:52:31 +03:00

[GH-ISSUE #1110] Quirks with clicking links in notifications #2626