CVE-2026-63406

A flaw was found in AnyCable's telemetry subsystem. This vulnerability allows for the disclosure of a stable fingerprint, which is derived from sensitive configuration data including secrets. This occurs because the telemetry client processes command-line arguments containing secrets and uses...

GO-2026-6529 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...

PT-2026-95514

Name of the Vulnerable Software and Affected Versions AnyCable versions prior to 1.6.15 Description The telemetry subsystem contains a hardcoded authentication token in telemetry/config.go used to authenticate to https://telemetry.anycable.io. Additionally, the clusterFingerprint function in...

CVE-2026-63406: Cleartext Storage of Sensitive Information

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...