Maestro fixes control-server flaw that could expose desktop access

The server and the URL token

On October 5, RunMaestro published GitHub advisory GHSA-q8p2-cpg2-fhpc, rating the issue High at CVSS 7.1. The advisory lists stable releases through 0.17.7 and release candidates from 0.18.0-RC through 0.18.7-RC as affected. It assigns no CVE.

Maestro’s desktop app runs an HTTP and WebSocket control server for maestro-cli and its browser and phone interfaces. In affected versions, the server listened on every network interface from app launch, even with Live Mode off. Turning Live Mode off restarted the server with a new token but did not return it to loopback. The server also reflected arbitrary Origin headers, accepted WebSocket upgrades from any origin, and wrote cli-server.json with default permissions (0644 on macOS and Linux).

Every route relied on a random UUID embedded in the URL as its only credential. A person who obtained that URL could run commands as the logged-in user, read and write files, and access AI conversation transcripts. The URL token is a necessary gate: the advisory does not describe a generally unauthenticated command endpoint.

How the URL could be exposed

The advisory identifies different paths with different prerequisites. Someone monitoring shared or hostile Wi-Fi could observe the plain-HTTP LAN URL while Live Mode was in use. A malicious web page that already knew the URL could use the permissive cross-origin API and WebSocket handling. Pairing or share links could leak the URL, and another local OS account could read the world-readable token file. The browser path depends on the page learning the URL; the advisory does not say every site automatically receives a token.

The public advisory and release notes do not report in-the-wild exploitation. They describe what an attacker with the URL could do, not confirmed victims or a specific campaign.

Fixes and what remains

The maintainers shipped the stable fix in v0.17.8 and the release-candidate fix in v0.18.8-RC. With Live Mode off, the server now binds to 127.0.0.1; enabling Live Mode opens LAN access, and disabling it returns the server to loopback with a fresh token. Foreign origins are refused, WebSocket upgrades from unapproved origins are closed, and the token file is written with mode 0600.

On older versions, Live Mode off did not close the network exposure. Update to a fixed release. With Live Mode on, the LAN URL still uses plain HTTP and the token remains the credential, so use a trusted network; the maintainer recommends its HTTPS tunnel for access elsewhere.