CVE-2026-8766 — Kilo-Org Kilocode Information Disclosure

title: CVE-2026-8766 - Kilo-Org Kilocode Environment Variable Handler Information Disclosure
id: scw-2026-05-17-ai-1
status: experimental
level: high
description: |
  This rule detects attempts to exploit CVE-2026-8766 by targeting the Load function in packages/opencode/src/config/config.ts. The exploit involves manipulating the KILO_CONFIG_CONTENT environment variable via a GET request to the specified path, potentially leading to information disclosure. A 200 status code suggests a successful retrieval of information.
author: SCW Feed Engine (AI-generated)
date: 2026-05-17
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8766/
tags:
  - attack.credential_access
  - attack.t1552
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/packages/opencode/src/config/config.ts'
      cs-uri-query|contains:
          - 'KILO_CONFIG_CONTENT='
      cs-method:
          - 'GET'
      sc-status:
          - '200'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse