資安週報Security Weekly

N-able 證實攻擊者利用 N-central 的認證繞過漏洞取得遠端管理權限，並進一步觸及透過這些主機所管理的客戶系統。這個漏洞編號 CVE-2026-18577（CVSS 8.2），起因是先前 CVE-2026-18556（CVSS 8.2）的修補並不完整——也就是說，已經套過第一次修補的環境仍然中招。

N-able 於 8 月 2 日釋出 2026.3.1.7 作為第一個不受影響的版本，CISA 隨即在 8 月 3 日將其列入 KEV 目錄。

N-able confirmed attackers exploited an authentication bypass in N-central to gain remote administrative access, then reached customer systems managed through those servers. Tracked as CVE-2026-18577 (CVSS 8.2), it exists because the earlier fix for CVE-2026-18556 (CVSS 8.2) was incomplete — environments that had already applied the first patch were still exposed.

N-able shipped 2026.3.1.7 on 2 August as the first unaffected build; CISA added the flaw to the KEV catalog on 3 August.

「Authentication Bypass Using an Alternate Path or Channel」——存在一條未經過正規驗證檢查的替代存取路徑。攻擊者不需要有效憑證即可取得管理帳號權限，接著就是合法功能的濫用：RMM 平台本來就有對受管端點派送指令與軟體的能力，接管平台等同取得下游環境的執行權。

這正是 RMM／MSP 類平台的風險特徵：單一漏洞的影響半徑不是一台主機，而是整個客戶名單。

"Authentication bypass using an alternate path or channel" — an access route that skips the normal verification check. No valid credentials are needed to reach administrative privileges, after which the attacker simply abuses legitimate functionality: an RMM platform exists to push commands and software to managed endpoints, so owning the platform means execution across everything downstream.

This is the defining risk of RMM/MSP tooling: the blast radius of one flaw is not one host, it is the entire customer list.

使用 N-central 的 MSP 與其所有客戶。若你是委外託管 IT 的一方，即使自家沒有裝 N-central，仍可能因服務商的平台被接管而受影響——這一題需要主動向你的 MSP 求證。

MSPs running N-central and all of their customers. If you outsource IT, you may be affected through your provider even without running N-central yourself — ask your MSP directly.

1. 立即升級至 2026.3.1.7 或更新版本。已套用前一次 CVE-2026-18556 修補的環境不能視為安全。
2. 升級前後都要做入侵跡證盤查：檢視管理主機的帳號建立紀錄、非預期的排程工作與腳本派送、對外連線紀錄。
3. 把 N-central 管理介面從公開網際網路移除，限制在 VPN 或特定來源 IP 之後。
4. 輪換 N-central 上的所有管理憑證與 API token。
5. 若你是委外方，向 MSP 索取其 N-central 版本與盤查結果。

1. Upgrade to 2026.3.1.7 or later immediately. Having applied the earlier CVE-2026-18556 patch does not mean you are safe.
2. Hunt for compromise either side of the upgrade: review account creation on the management server, unexpected scheduled tasks and script deployments, and outbound connections.
3. Take the N-central console off the public internet — put it behind VPN or source-IP restrictions.
4. Rotate every administrative credential and API token in N-central.
5. If you outsource IT, ask your MSP for their N-central build number and hunt results.

在受管端點側觀察「經由 RMM agent 派送、但不在你變更紀錄裡」的執行行為——這比在被接管的管理主機上找記錄更可靠，因為攻擊者有能力清理後者。

Look at the managed-endpoint side for execution delivered via the RMM agent that has no matching entry in your change record. That is more reliable than trusting logs on a management server the attacker controlled.

一支竊取憑證的 npm 蠕蟲最早出現在 keyv@6.0.0，並於 8 月 4 日擴散到多個組織的數百個套件。各家統計的規模不一：SafeDep 驗證出 79 個套件名稱下的 353 個受污染版本，其監測顯示更廣的足跡達 353 個名稱下的 442 個版本，Aikido 通報至少 868 個套件；BleepingComputer 以 ChainDrop 稱呼這波攻擊，指其影響超過 1,300 個套件、合計每月下載量約 20 億次。

特別值得注意的是，惡意程式會在受害機器上植入 Claude Code 與 VS Code 的 hook——也就是說它不只竊取當下的憑證，還在開發環境裡留下持續執行的位置。

A credential-stealing npm worm first appeared in keyv@6.0.0 and spread into hundreds of packages across multiple organisations on 4 August. Counts differ by vendor: SafeDep verified 353 poisoned versions across 79 package names, with monitoring suggesting a wider footprint of 442 versions across 353 names; Aikido reported at least 868 packages. BleepingComputer tracks the campaign as ChainDrop and puts it at more than 1,300 packages with roughly 2 billion combined monthly downloads.

Notably, the malware plants Claude Code and VS Code hooks on victim machines — it does not merely steal the credentials present at install time, it establishes a persistent foothold inside the development environment.

自我傳播的邏輯是：竊取開發者的 npm 發布 token → 用該 token 對開發者有權限的套件發布植入惡意程式的新版本 → 這些套件的使用者安裝後再次被竊取 token。每一次感染都會製造新的傳播源，這是它能在一天內從單一套件擴散到上千個的原因。

感染途徑是安裝期腳本，不需要你在程式中真的呼叫那個套件。

The propagation loop: steal a developer's npm publish token → use it to publish trojanised versions of every package that developer can publish → users of those packages install, and their tokens are stolen in turn. Each infection manufactures a new propagation source, which is how it went from one package to over a thousand within a day.

Infection happens through install-time scripts — you do not have to actually call the package in your code.

任何在本週執行過 npm install 且相依樹中包含受影響套件的開發者機器與 CI 環境。因為是相依傳遞，你的 package.json 沒有直接列出 keyv 不代表沒有中招。

Any developer machine or CI environment that ran npm install this week with an affected package anywhere in its dependency tree. Because it spreads transitively, keyv not appearing in your package.json does not mean you are clear.

1. 輪換所有 npm token，以及該機器上曾出現過的其他憑證（雲端 key、CI secret、SSH key）。
2. 用 npm ls keyv cacheable 檢查相依樹；有命中就比對受影響版本清單。
3. 檢查 ~/.claude/settings.json 與 VS Code 設定中是否有非你新增的 hook 或 task。
4. CI 端加上 npm ci --ignore-scripts，阻斷安裝期腳本這條路徑。
5. 導入 lockfile 審查與相依掃描（本期工具 Trivy 可掃 package-lock.json）。

1. Rotate every npm token, plus any other credential that has been present on the machine (cloud keys, CI secrets, SSH keys).
2. Check your tree with npm ls keyv cacheable; if it hits, compare against the affected-version lists.
3. Inspect ~/.claude/settings.json and your VS Code configuration for hooks or tasks you did not add.
4. Use npm ci --ignore-scripts in CI to cut off the install-script path.
5. Adopt lockfile review and dependency scanning — Trivy, featured this week, scans package-lock.json.

在開發者機器與 CI runner 上找 npm install 期間產生的非預期對外連線，特別是連往非 registry 網域者。另外檢查 npm 帳號的發布紀錄有無你不認得的版本。

Hunt for unexpected outbound connections during npm install on developer machines and CI runners, especially to non-registry domains. Also review your npm account's publish history for releases you do not recognise.

Langflow 存在程式碼注入漏洞，未經驗證的攻擊者可在預設部署上取得完整遠端程式碼執行權限。CISA 已於 8 月 4 日將其列入 KEV 目錄，代表已有實際遭利用的證據。

這一則的重點在「預設部署」四個字——不需要特殊設定錯誤，開箱即用的狀態就是可利用的。

Langflow contains a code injection flaw that lets unauthenticated attackers achieve full remote code execution on default deployments. CISA added it to the KEV catalog on 4 August, indicating confirmed exploitation in the wild.

The operative phrase is "default deployments" — no unusual misconfiguration required; out of the box is exploitable.

程式碼注入（CWE-94）：使用者可控的輸入被送進會執行程式碼的處理路徑。AI 工作流平台這類產品常見的設計是允許使用者定義自訂節點或運算式，若這段執行環境沒有與外部輸入隔離，就等同對外開放一個直譯器。

Code injection (CWE-94): user-controlled input reaches a path that executes code. Products like AI workflow builders commonly let users define custom nodes or expressions; when that execution context is not isolated from untrusted input, it amounts to exposing an interpreter to the internet.

任何對外開放的 Langflow 執行個體。因為這類工具常在概念驗證階段被快速架起來、之後忘了收掉，先盤點你組織裡有沒有沒人認領的 Langflow。

Any internet-reachable Langflow instance. These tools often get stood up for a proof of concept and then forgotten, so start by finding the Langflow nobody remembers owning.

1. 依 IBM 公告升級至已修補版本。
2. 在完成修補前，將 Langflow 從對外網段撤下。
3. 假設已遭入侵並進行盤查：Langflow 執行身分下的異常程序、對外連線、新增的檔案。
4. 輪換該主機上所有 API key——AI 工作流平台通常存放大量第三方服務憑證。

1. Upgrade to the fixed release per IBM's advisory.
2. Until patched, remove Langflow from internet-facing networks.
3. Assume compromise and hunt: anomalous processes under the Langflow service account, outbound connections, newly written files.
4. Rotate every API key on that host — AI workflow platforms typically hold a lot of third-party service credentials.