Neko Virtual Browser: Authenticated RCE to Admin Takeover

A critical vulnerability, CVE-2026-39386 (CVSS 8.8 HIGH), in Neko virtual browser versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allows any authenticated user to escalate privileges to full administrative control. The National Vulnerability Database confirms this grants immediate authority over member management, room settings, broadcast control, and session termination, leading to a complete compromise of the Neko instance.

This isn’t a theoretical flaw; it’s a direct path to total control for anyone with a valid login. The attacker’s calculus is simple: get a low-privilege account, then own the entire virtual browser environment. The National Vulnerability Database indicates that patches are available in v3.0.11 and v3.1.2.

Defenders should prioritize upgrading immediately. If that’s not feasible, temporary mitigations include restricting access to trusted users, enforcing strong passwords, running instances only when necessary, placing Neko behind additional authentication layers like a reverse proxy, and monitoring for suspicious administrative actions. Disabling or restricting access to the /api/profile endpoint is also suggested, though these are temporary measures and do not eliminate the core vulnerability.