CVE-2026-103098
7.5 HIGHPublished 2026-10-02 · Updated 2026-10-02
AI risk analysis
- Summary
- The flaw allows sensitive keys to be transmitted in plaintext over unencrypted HTTP connections, making them vulnerable to interception by network monitoring attackers. This creates a significant risk of credential exposure and potential unauthorized access.
- Exploitability
- Exploitation is relatively straightforward for network-monitoring attackers who can intercept HTTP traffic, requiring no privileged access or complex payloads.
- Blast radius
- The impact could be substantial across all systems that transmit sensitive keys over HTTP, potentially exposing authentication tokens, API keys, or session identifiers to attackers.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 2.590 or later to address the insecure transmission of sensitive keys over HTTP connections.
webcredential-exposurenetwork-traffic
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-319
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-95276PoC
- HIGHCVE-2026-107232PoC
- HIGHCVE-2015-20122
- HIGHCVE-2020-37278PoC
- CRITICALCVE-2020-37282PoC
- HIGHCVE-2022-4997
- HIGHCVE-2022-51019PoC
- CRITICALCVE-2023-54399
Related by shared AI tags and CWE weakness class. Browse the full archive.