Submit finding

All findings

CVE-2026-43617 + 6 more critical

ZeroPath public research adds seven CVEs and one reserved Monaco report

ZeroPath's public research identifies seven additional published CVEs across rsync, AutoGPT, Keycloak, OpenClaw, Avahi, E2nest, and Fonoster, plus a reserved and inconsistently described Monaco identifier.

Bug class
Authorization bypass, session hijacking, RCE, denial-of-service, and local file inclusion
Affected codebase
rsync, AutoGPT, Keycloak, OpenClaw, Monaco, Avahi, E2nest, and Fonoster
Credited system
ZeroPath AI SAST
Disclosed
May 20, 2026
Attribution
Self-reported attribution
Severity
critical
Source status: ZeroPath's Wall of Fame and research posts supply AI-platform attribution. Public records independently corroborate the seven CVEs in cveId. CVE-2024-48946 remains reserved, and ZeroPath's own pages disagree on whether it labels Monaco RCE or unauthorized Redis access, so it is excluded from the CVE counter.

Summary

The CVE-backed portion covers rsync hostname ACL bypass, AutoGPT session hijacking, Keycloak authorization failure, OpenClaw cross-origin WebSocket hijacking, Avahi denial of service, and local-file-inclusion flaws in E2nest and Fonoster.

ZeroPath also publicly uses CVE-2024-48946 for Monaco. Its Wall of Fame and zero-day archive associate the ID with pickle-deserialization RCE, while its “How ZeroPath Works” article associates the same reserved ID with unauthorized Redis access. No published CVE record currently resolves that conflict. The Monaco report remains documented here as reserved context but is deliberately absent from the cveId field and the global unique-CVE total.

Attribution boundary

The seven counted vulnerabilities have independent public records. The statement that ZeroPath’s AI-native workflow discovered them comes from ZeroPath, so the cluster is labeled self-reported. The reserved Monaco claim is not treated as independently corroborated. Direct Linux credits are kept in a separate two-CVE kernel entry.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.