CVE-2026-37012 in PentestGPT
Summary
by MITRE • 08/27/2026
A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The identified security flaw resides within the core language processing module of PentestGPT version 1.0.0, specifically affecting the langfuse integration component. This vulnerability stems from a critical misconfiguration where Application Programming Interface credentials are hard-coded directly into the source code rather than being managed through secure environment variables or secret management systems. By embedding sensitive authentication tokens within the application binary or script files, the software inadvertently exposes these secrets to any individual with access to the codebase, including remote attackers who may obtain copies of the repository or intercepted deployment artifacts. This practice violates fundamental security principles regarding credential hygiene and significantly increases the attack surface by transforming what should be a protected secret into publicly accessible data.
The operational impact of this vulnerability is severe due to the nature of telemetry data collected by PentestGPT. Telemetry typically encompasses detailed logs, user interaction patterns, command histories, and potentially sensitive information related to security assessments being conducted through the tool. Because the API credentials are static and exposed, an attacker can authenticate against the Langfuse backend service using these stolen keys. Once authenticated, the attacker gains unauthorized access to the telemetry dashboard or data streams associated with the affected instances of PentestGPT. This allows for the exfiltration of sensitive user telemetry data, which could reveal proprietary security strategies, internal network structures discovered during pentests, and other confidential operational details that organizations rely on to maintain their defensive postures.
From a classification perspective, this vulnerability aligns closely with CWE-798: Use of Hard-coded Credentials, as it involves the use of static authentication information within software code. Furthermore, the ability for remote attackers to access sensitive data via exposed credentials relates to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. In terms of adversary tactics, this scenario maps to ATT&CK technique T1539: Steal Web Session Cookies or similar credential harvesting methods where pre-existing secrets are leveraged for unauthorized access. The lack of dynamic secret rotation means that once the credentials are compromised, they remain valid until manually rotated by developers, providing a persistent window of opportunity for exploitation.
To mitigate this risk, immediate remediation steps must focus on removing all hard-coded API keys from the source code and replacing them with secure configuration methods such as environment variables or dedicated vault solutions like HashiCorp Vault or AWS Secrets Manager. Developers should audit the entire repository history to ensure that previous commits containing these secrets are purged using tools designed for sensitive data removal, preventing historical exposure. Additionally, all compromised credentials must be rotated immediately to invalidate any stolen tokens. Implementing pre-commit hooks with secret scanning tools can help prevent future occurrences by detecting hard-coded secrets before they are merged into the main branch. Regular security audits and adherence to secure coding standards will further reduce the likelihood of similar misconfigurations in subsequent releases.