Spikster npm Package Vulnerability: Critical Missing Authentication Issue
An early warning has been issued regarding a critical vulnerability in the Spikster npm package, which reportedly allows unauthenticated remote attackers to access all API routes.
What happened
The Spikster npm package is under investigation for containing a missing authentication vulnerability, tracked as CVE-2026-67594. This vulnerability appears to allow unauthenticated remote attackers to access all API routes due to the unattached CipiAuth middleware. Attackers could potentially invoke unprotected API endpoints to perform malicious actions such as enumerating and provisioning servers, resetting root passwords, reading and writing arbitrary files on the host, and creating database users.
Professional software engineers using Spikster are advised to assess their exposure by reviewing their usage of the package. It is recommended to upgrade to a version of Spikster that applies the CipiAuth middleware to all API routes and to rotate any secrets in affected environments. For the most accurate and up-to-date information, primary sources such as the NVD should be consulted.
How 0Day mitigates this
spikster is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.