CVE-2026-85181: CAT Session Cookie Forgery Grants Admin Access

Overview

A critical authentication bypass vulnerability has been disclosed in CAT (Centralized Application Tracking), the open-source application performance monitoring platform maintained by Dianping (dianping/cat on GitHub). Tracked as CVE-2026-85181, the flaw allows an unauthenticated attacker to forge valid session cookies offline and mint arbitrary sessions — including full administrative access to CAT's configuration console.

The root cause is a classic cryptographic shortcut: CAT uses Java's built-in String.hashCode() as the sole integrity check for session cookies, with no server-side secret key involved in the computation. Because hashCode() is a well-documented, deterministic, and publicly specified algorithm, anyone can compute a "valid" checksum for any cookie value they choose — no signing key, no server interaction, and no brute force required.

Technical Details

How It Works

CAT's session token generation logic in TokenBuilder.java builds a session cookie and appends a checksum derived purely from String.hashCode() over the token's contents. Because this hashing routine is not keyed with any server-side secret, an attacker who understands the token format can:

1. Construct an arbitrary session payload — including one asserting an admin role
2. Compute the matching hashCode() checksum entirely offline
3. Present the forged cookie to the CAT web console as a valid, integrity-checked session

Compounding the issue, HttpUtils.java performs IP-based session binding by trusting the client-supplied X-Forwarded-For header rather than validating against a trusted proxy chain. An attacker can simply set this header to whatever IP the forged session expects, defeating the IP-binding control entirely.

Chained together, these two flaws let an unauthenticated attacker walk directly into an administrative session with full configuration access to the CAT instance.

Impact Assessment

Who Is At Risk

Any organization running a network-accessible CAT ≤ 3.1.0 deployment is vulnerable, including:

• Internal APM/monitoring dashboards exposed beyond a tightly controlled internal network
• Multi-tenant or shared observability platforms built on CAT
• Environments where CAT's admin console is reachable from developer or CI networks

Potential Attack Chains

1. Session Forgery — Attacker computes a forged admin session cookie offline using the known hashCode() algorithm
2. IP-Binding Bypass — Attacker sets X-Forwarded-For to satisfy the session's expected source IP
3. Admin Console Access — Attacker authenticates as admin with no credentials, gaining full configuration control
4. Downstream Impact — Depending on deployment, admin access to CAT can expose monitored application topology, metrics, and potentially connected credentials or integration endpoints

Mitigation

Immediate Actions

• Restrict network exposure of the CAT web console to trusted internal networks only — do not expose it directly to the internet
• Strip or ignore client-supplied X-Forwarded-For headers at the load balancer/proxy layer, and only trust IP information set by your own trusted reverse proxy
• Monitor for anomalous admin logins, particularly sessions with no corresponding prior authentication event
• Watch the upstream repository (dianping/cat, tracked via GitHub Issue #2384) for a patched release, as the advisory does not yet list a fixed version

Detection Opportunities

• Admin-role sessions that appear without a preceding login request
• Requests bearing unusual or spoofed X-Forwarded-For values reaching the CAT console
• Session cookies with structurally unusual or malformed token segments

Defence-in-Depth

• Place CAT behind an authenticating reverse proxy or SSO gateway independent of CAT's own session logic
• Segment CAT's admin interface onto a separate network path from read-only dashboards
• Rotate any credentials or tokens accessible via CAT's configuration console as a precaution

Background

CAT is widely used as an internal application performance and tracing platform, particularly in organizations that adopted it as an early open-source APM solution. Session-integrity failures like this one are a reminder that unkeyed hash functions (hashCode(), CRC32, plain MD5 without a secret) are not a substitute for a proper HMAC when the goal is tamper-evidence — the algorithm being public and deterministic means anyone can reproduce it.

Given the pre-auth, no-brute-force nature of this exploit path, defenders running CAT should treat this as a high-priority remediation item until an upstream fix lands.

References

• VulnCheck Advisory — CAT Session Cookie Forgery via Unkeyed hashCode Checksum
• NVD — CVE-2026-85181
• dianping/cat GitHub Issue #2384