Go/github.com/anycable/anycable CVE-2026-63406: medium 5.9, EPSS 0.30%

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

Action: Upgrade github.com/anycable/anycable to 1.6.15 or later.

go get github.com/anycable/anycable@v1.6.15

Affected

Fixed versions

Sources

• osv: GHSA-w72w-9qmj-c9qm
• https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm
• https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee
• https://github.com/anycable/anycable
• https://github.com/anycable/anycable/releases/tag/v1.6.15

CVE-2026-63406 · published 2026-09-18T17:17:29Z · modified 2026-09-28T17:11:11.851359767Z · JSON