CVE-2026-116283 in Kameleo
Summary
by MITRE • 10/26/2026
A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected component is advised.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
A critical security weakness has been identified within Kameleo, specifically affecting versions up through 5.0.1.26. This vulnerability resides in an unspecified segment of the Local API component, which serves as a bridge for external applications to interact with the browser automation software. The core issue involves improper access control mechanisms governing sensitive data stored within the /profiles directory structure. Because this path typically contains configuration files, session cookies, fingerprinting data, and potentially authentication tokens required for maintaining user sessions across various web services, unauthorized access to these resources constitutes a significant information disclosure risk.
The technical flaw allows an attacker to exploit the Local API endpoint without requiring prior authentication or proper authorization checks in certain contexts. By sending specifically crafted requests to the local interface, which is often exposed on loopback addresses such as 127.0.0.1, an adversary can retrieve sensitive profile data. Although the attack vector is described as remote, it typically implies that any process running on the same host machine with network stack access can trigger this disclosure. This scenario is particularly dangerous in environments where multiple applications or services are co-located, such as virtual machines, containers, or shared workstations used for web automation and testing purposes.
From a classification perspective, this vulnerability aligns closely with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The failure lies in the application's inability to enforce strict access controls on internal API endpoints that handle sensitive user data. Furthermore, from a tactical standpoint related to the MITRE ATT&CK framework, this behavior is consistent with techniques used for Credential Access and Discovery, specifically T1539: Steal Web Session Cookie or T1087: Account Discovery. The attacker leverages these disclosed credentials or session tokens to impersonate legitimate users, bypassing multi-factor authentication if the stolen data includes sufficient identity markers, thereby gaining unauthorized access to associated online accounts.
The operational impact of this vulnerability is severe for organizations relying on Kameleo for marketing automation, ad verification, or account management tasks. The exposure of browser fingerprints and session cookies can lead directly to account takeover incidents, where attackers hijack active sessions to perform fraudulent activities under the victim's identity. Additionally, the leakage of fingerprinting data may allow adversaries to build detailed profiles of user behavior patterns, facilitating more sophisticated social engineering attacks or targeted phishing campaigns tailored to specific individuals based on their browsing habits and preferences stored in those profile files.
To mitigate this risk, immediate action is required by upgrading Kameleo to version 5.2.0 or later, as the vendor has addressed these access control deficiencies in subsequent releases. It is strongly advised that administrators verify the installed version across all endpoints running the software and apply patches promptly. In addition to updating the software, organizations should implement network segmentation strategies where possible, ensuring that local API services are not unnecessarily exposed to broader networks even if they bind to loopback interfaces by default. Monitoring for unusual outbound traffic or unexpected access patterns to local ports can also serve as an early detection mechanism while patching efforts are underway.