CVE-2026-63406

Go/github.com/anycable/anycable CVE-2026-63406: medium 5.9

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

Action: Upgrade github.com/anycable/anycable to 1.6.15 or later.

go get github.com/anycable/anycable@v1.6.15

Affected

Fixed versions

Sources

• osv: GHSA-w72w-9qmj-c9qm
• https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm
• https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee
• https://github.com/anycable/anycable
• https://github.com/anycable/anycable/releases/tag/v1.6.15

CVE-2026-63406 · published 2026-09-18T17:17:29Z · modified 2026-09-28T17:11:11.851359767Z · JSON

Go/github.com/anycable/anycable-go CVE-2026-63406: unknown

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-6529
• https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm
• https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee
• https://github.com/anycable/anycable/releases/tag/v1.6.15

CVE-2026-63406 · published 2026-09-28T16:43:40Z · modified 2026-09-28T17:00:21.658190463Z · JSON