CVE-2026-86543: knowns Unauthenticated Management API Exposure
A developer tool that binds 0.0.0.0, disables its own auth middleware when no password is set, and exposes an unauthenticated tunnel-start endpoint does not just have an exposure problem — it has a self-publishing one.