Feed
Get Entry
GET
/api/v1/feed/{handle}One entry by any handle it has had: ETK, CVE, GHSA or EUVD id, or an earlier or merged id. Adds sources, references, verification and, when the handle matched an alias, resolved_from.
Path Parameters
handle*string
ETK, CVE, GHSA or EUVD id. Aliases match case-insensitively.
Response Body
application/json
application/json
application/json
curl -X GET "https://zero.ethiack.com/api/v1/feed/CVE-2026-111823"{
"affected": [
{
"affected_notes": [],
"affected_ranges": [
">= 0, <= 0.9.80"
],
"ecosystem": null,
"fixed_versions": [],
"package_name": "mage-ai",
"purl": null
}
],
"anchor_state": "anchored",
"automation": "deterministic",
"check": true,
"check_claim": {
"confidence_basis": "differential",
"evidence": "observed",
"label": "safe active check"
},
"check_confidence_basis": "differential",
"cve_id": "CVE-2026-111823",
"cvelist_commit_at": null,
"cvelist_commit_sha": null,
"cvss_score": 9.8,
"cvss_src": "cna_vendor",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvss_version": "3.1",
"cwes": [
390
],
"delta_is_lower_bound": false,
"details_pending": false,
"display_id": "CVE-2026-111823",
"epss_asof": null,
"epss_percentile": null,
"epss_score": null,
"etk_id": "ETK-2026-1823",
"euvd_id": "EUVD-2026-103205",
"exploit": true,
"first_run_started_at": "2026-10-16T23:33:31.809146+00:00",
"ghsa_id": "GHSA-93gm-r5p2-wxq7",
"had_prior_signal": false,
"last_run_finished_at": "2026-10-17T12:26:57.235442+00:00",
"last_run_started_at": "2026-10-17T12:01:58.009975+00:00",
"logo_key": "gh:mage-ai:mage-ai",
"mitigation": "Update to a Mage release that includes commit 76c4f46. Until an updated release is deployed, disable or restrict OAuth-based session creation to reduce exposure.",
"pipeline_minutes": 24.987091116666665,
"product": "mage-ai",
"published_at": "2026-10-16T23:33:23.944513+00:00",
"references": [
{
"credit": null,
"first_seen": "2026-10-17T11:34:16.869689+00:00",
"label": "murrez/CVE-2026-111823",
"system": "github",
"url": "https://github.com/murrez/CVE-2026-111823"
}
],
"seq": 1854,
"signals": {
"check": {
"at": "2026-10-17T12:26:57.235442+00:00",
"days": 0.5489350861342592,
"is_lower_bound": false,
"measured_at": "2026-10-16T23:16:29.244000+00:00",
"url": null
},
"exploit": {
"at": "2026-10-17T12:26:57.235442+00:00",
"days": 0.5489350861342592,
"is_lower_bound": false,
"measured_at": "2026-10-16T23:16:29.244000+00:00",
"url": null
},
"public_poc": {
"at": "2026-10-17T09:53:31+00:00",
"days": 0.4423814351851852,
"is_lower_bound": false,
"measured_at": "2026-10-16T23:16:29.244000+00:00",
"url": "https://github.com/murrez/CVE-2026-111823"
},
"trigger_signal": {
"at": "2026-10-16T23:16:29.244000+00:00",
"days": 0,
"is_lower_bound": false,
"measured_at": "2026-10-16T23:16:29.244000+00:00",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111823"
}
},
"sources": [
{
"is_trigger": true,
"kind": "advisory",
"label": "cve_org: trigger signal",
"observed_at": "2026-10-16T23:33:16.697613+00:00",
"published_at": "2026-10-16T23:16:29.244000+00:00",
"published_at_evidence_url": null,
"published_at_precision": "exact",
"ref": null,
"system": "cve_org",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111823"
}
],
"status": "published",
"summary": "Mage OSS/mage-ai versions through 0.9.80 can create a session when an unknown OAuth provider is supplied. An unauthenticated remote attacker may obtain a session where OAuth-based session creation is exposed.",
"superseded_by_etk_id": null,
"t0_at": "2026-10-16T23:16:29.244000+00:00",
"title": "OAuth authentication bypass in Mage mage-ai",
"updated_at": "2026-10-18T01:05:38.668035+00:00",
"vendor": "Mage",
"verification": {
"attempts": null,
"basis": "differential",
"claim": "validated_once",
"provenance": "self_built",
"review_note": null,
"successes": null,
"verified_at": "2026-10-17T12:27:04.995779+00:00"
},
"withdrawal_reason": null,
"withdrawn_at": null
}Empty
{
"error": "not_found"
}Empty
{
"error": "internal"
}