Live › vulnerability › CVE-2026-104384
Go to dashboardEagleCloud Aquila versions through 2.6.7.2 on on-premises platforms expose credentials in its tunnel gateway and provisioning interfaces. An unauthenticated remote attacker can abuse authentication to escalate privileges and read access keys, secret keys and deployment secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 05:31 UTC. All times on this page are UTC.
On-premises deployments of EagleCloud Aquila at or below version 2.6.7.2 with the tunnel gateway or provisioning interfaces exposed are affected. Teams running only managed or hosted Aquila, or versions newer than 2.6.7.2, can skip it; unknown whether the sources confirm any default configuration.
No product ranges from the sources yet.
2.6.7.2; unknown whether the sources list a fixed build2.6.7.2; unknown exact fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access the access keys, secret keys, and deployment secrets
This page as .md · .json · in your agent: get_signal("CVE-2026-104384")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.