CVE-2026-86543 [CRITICAL] – knowns versions before 0.30.0 serve the management API without authentication on all netwo

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.