A critical vulnerability in knowns versions prior to 0.30.0 allows unauthenticated remote attackers to gain unauthorized access to the management API, leading to potential system compromise.

The application fails to enforce authentication on its management API by default, specifically within the /api/tunnel/start endpoint. This flaw allows an unauthenticated user to interact with administrative functions and provision public tunnels that expose the internal API to the internet.

Successful exploitation of this vulnerability permits unauthorized actors to gain full control over the management API, which can lead to data exfiltration, unauthorized configuration changes, and severe system compromise. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it requires no user interaction or prior authentication to achieve full impact on the confidentiality and integrity of the affected environment.

Immediate Action: Update knowns to version 0.30.0 or later immediately to enforce mandatory authentication for all management API endpoints.

Proactive Monitoring: Review system access logs for unauthorized requests to the /api/ tunnel/start endpoint and monitor for unexpected network tunnel provisioning activity.

Compensating Controls: Implement strict network access control lists to restrict traffic to the management API port, ensuring it is only accessible from trusted internal IP addresses until the patch is applied.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability, combined with the ease of exploitation, necessitates immediate action. Administrators must upgrade to version 0.30.0 as the primary mitigation. If an immediate upgrade is not feasible, ensure the service is bound only to local interfaces and protected by firewall rules to prevent unauthorized remote access to the management API.