{"action":"Upgrade github.com/anycable/anycable to 1.6.15 or later.","affected":[{"fixed":"1.6.15","introduced":"0"}],"component":"github.com/anycable/anycable","cve_ids":["CVE-2026-63406"],"ecosystem":"Go","epss":0.003,"exploited":false,"fixed_versions":["1.6.15"],"ghsa_id":"GHSA-w72w-9qmj-c9qm","id":"tcs_01M5KFQBQ66J2B2CRCDF756NRH","modified_at":"2026-09-28T17:11:11.851359767Z","published_at":"2026-09-18T17:17:29Z","references":["https://osv.dev/vulnerability/GHSA-w72w-9qmj-c9qm","https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm","https://github.com/anycable/anycable/commit/201c67e99e463ed63bd6b345562f4c458385fcee","https://github.com/anycable/anycable","https://github.com/anycable/anycable/releases/tag/v1.6.15"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-w72w-9qmj-c9qm","url":"https://osv.dev/vulnerability/GHSA-w72w-9qmj-c9qm"}],"summary":"AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets"}