CVE-2026-92759
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints.
Schwachstellenklasse
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints.
Quellen
- https://github.com/SecObserve/SecObserve
- https://github.com/SecObserve/SecObserve/blob/v1.54.0/backend/application/import_observations/api/serializers.py#L103-L119
- https://github.com/SecObserve/SecObserve/issues/4799
- https://github.com/SecObserve/SecObserve/releases/tag/v1.59.1
- https://github.com/SecObserve/SecObserve/security/advisories/GHSA-r968-78vw-jj9m
- https://www.vulncheck.com/advisories/secobserve-before-1.59.1-information-disclosure-via-api-configuration
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.