CVE-2026-45087: Dalfox REST API RCE

Detection Guidance

Start by identifying Dalfox processes running in server mode and determining whether TCP port 6664 is reachable beyond the local host.

Review:

• Process supervisors
• Container manifests
• Kubernetes Services
• Cloud security groups
• Reverse-proxy routes
• Host firewall rules
• Network access-control lists

The default listener address is 0.0.0.0:6664, but a non-default port does not establish safety.

Look for HTTP requests to the Dalfox API, especially POST /scan, and inspect request bodies where application logging or a reverse proxy preserves JSON payloads. Suspicious requests may include:

• FoundAction or FoundActionShell values
• Shell metacharacters
• Command interpreters
• Encoded commands
• Scan targets not authorized by the operator

Technical Notes

A basic host-triage workflow can identify listening services and parent-child process relationships:

ss -lntp | grep -E '(:6664|dalfox)'
ps -eo pid,ppid,user,etimes,args --forest | grep -i '[d]alfox'

If Dalfox runs under Docker or Kubernetes, inspect published ports and service exposure:

docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Ports}}\t{{.Command}}' | grep -i dalfox
kubectl get pods,svc -A -o wide | grep -i dalfox

A focused web-log search should cover the vulnerable endpoint and execution-option names:

grep -R -Ei \
  '"(POST|post) /scan|FoundAction(Shell)?|/scan[^"]*' \
  /var/log/nginx /var/log/apache2 /var/log 2>/dev/null

For network monitoring, alert on connections to the Dalfox listener and unexpected outbound connections from the Dalfox process:

(dst_port == 6664) OR
(process_name == "dalfox" AND outbound_connection == true)

This is not a complete exploit signature. A request may trigger execution only after a scan finding, and command output may be sent through a separate channel.

Correlate API requests with process-creation events, including shells and interpreters:

parent_process in ("dalfox", "dalfox.exe") AND
child_process in ("sh", "bash", "dash", "ash", "cmd.exe", "powershell.exe", "pwsh")

Investigate:

• Commands launched by the Dalfox account
• Unexpected files near the binary or working directory
• Outbound connections following /scan requests
• Access to cloud metadata services
• Access to credential files
• New users or persistence mechanisms
• Modified service or scheduled-task files

Remediation and Patching

Upgrade all affected installations to Dalfox 2.13.0 or later. Verify the installed version after upgrading and confirm that the deployed binary or container image, rather than only a build workstation, has changed.

For a source or Go-based installation, use the project’s release tag and rebuild or install the fixed version according to the project’s supported procedure:

go install github.com/hahwul/dalfox/v2@v2.13.0
dalfox version

If the deployment uses a packaged binary or container, replace it with an artifact corresponding to Dalfox 2.13.0 or later. Verify the image digest or binary provenance through the organization’s normal release-validation process.

Immediate Mitigations

If immediate upgrade is not possible, stop REST API server instances and block the listener at host and network boundaries:

sudo systemctl stop dalfox
sudo nft add rule inet filter input tcp dport 6664 drop

For environments using UFW, an equivalent emergency control is:

sudo ufw deny 6664/tcp

Firewall syntax varies by platform. Validate the effective rules and confirm that the port is no longer reachable from unauthorized networks.

Do not rely only on binding changes unless the deployment has been explicitly configured and tested to listen on a trusted local or private interface.

If the service must remain available temporarily:

1. Configure API-key authentication with the supported --api-key option.
2. Place the service behind an authenticated, access-controlled network path.
3. Restrict access to approved administration or automation systems.
4. Monitor API requests and process creation closely.
5. Upgrade as soon as possible.

Authentication and network restrictions are defense-in-depth measures, not substitutes for upgrading.

Incident Response Considerations

After containment, review historical API and reverse-proxy logs for /scan requests and attacker-controlled FoundAction or FoundActionShell values.

Examine affected hosts for:

• Shells and interpreters launched by Dalfox
• Download utilities and encoded commands
• Unexpected persistence
• New users
• Modified service files
• Credential access
• Outbound connections
• Cloud metadata access
• Unauthorized changes to scan targets or configurations

If unauthorized command execution is suspected:

1. Isolate the host.
2. Preserve volatile and disk evidence.
3. Rotate credentials available to the Dalfox process.
4. Review lateral movement and cloud activity.
5. Follow the organization’s incident-response procedures.

For additional context when evaluating suspicious account activity, see how to tell if an email has been hacked. While email compromise is not required for exploitation of this vulnerability, stolen credentials discovered during investigation may indicate broader intrusion activity.

References

1. NVD: CVE-2026-45087
2. Dalfox 2.13.0 release
3. GitHub Security Advisory: GHSA-v25v-m36w-jp4h
4. CISA Known Exploited Vulnerabilities Catalog

The available references support treating CVE-2026-45087 as a critical vulnerability in Dalfox REST API server deployments, with a fixed version of 2.13.0. They do not establish confirmed exploitation in the wild or a verified public PoC. Organizations should use their own telemetry and incident-response evidence to determine whether a reachable instance was targeted.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.