high

CVE-2026-124653

Mine CloudVod < 2.6.6 hands signed upload policies and temporary cloud-storage credentials (Alibaba OSS, Tencent COS, Dogecloud) to unauthenticated callers of its REST routes

Severity: high
Affected product: mine-cloudvod
Affected versions: mine-cloudvod < 2.6.6
Fixed in: mine-cloudvod 2.6.6
Detection basis: Component version range
Shipped rule: mine-cloudvod: Mine CloudVod < 2.6.6 hands signed upload policies and temporary cloud-storage credentials (Alibaba OSS, Tencent COS, Dogecloud) to unauthenticated callers of its REST routes
Added to NewScan: 2026-11-13
Detected by: NewScan — free, self-hosted

How NewScan reports it

COMPONENT VERSION RANGE

NewScan fingerprints mine-cloudvod from its response and reports this CVE when the detected version falls inside the affected range below.

References

NVD — CVE-2026-124653 ↗
CVE Record ↗

Scan for this yourself — local, in-band scanning is free.

Get NewScan (FREE) →

Review the measured benchmark, then use the verified remediation process.