--- title: "CVE-2026-105858: Payload - Remote Code Execution" description: "Payload < 3.90.0 and canary < 4.0.0-canary.34 contains a remote code execution caused by crafted requests to the public first-register operation when local authentication is enabled and no initial user exists, letting attackers execute code remotely." url: https://panop.io/threat-heartbeat/CVE-2026-105858/ --- # CVE-2026-105858 Payload - Remote Code Execution Payload < 3.90.0 and canary < 4.0.0-canary.34 contains a remote code execution caused by crafted requests to the public first-register operation when local authentication is enabled and no initial user exists, letting attackers execute code remotely. CVSS base score 8.1 /10 High CISA KEV Not listed Public exploit None known EPSS 0.48% chance of exploitation in 30 days [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-105858) ## Details Type Remote Code Execution Impact Remote Code Execution CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Published 6 October 2026 Updated 15 October 2026 Weakness [CWE-94](https://cwe.mitre.org/data/definitions/94.html) ## Vendor fix Upgrade to versions 3.90.0 or 4.0.0-canary.34 or later. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-105858](https://nvd.nist.gov/vuln/detail/CVE-2026-105858) - [https://github.com/payloadcms/payload/releases/tag/v3.90.0](https://github.com/payloadcms/payload/releases/tag/v3.90.0) - [https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv](https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv) - [https://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679](https://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)