{"id":"CVE-2026-104384","kind":"vulnerability","aliases":["CVE-2026-104384"],"related":[],"title":"EagleCloud Aquila: unauthenticated attackers reach access keys and deployment secrets","description":"Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access the access keys, secret keys, and deployment secrets","summary":"EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms expose credentials in its tunnel gateway and provisioning interfaces. An unauthenticated remote attacker can abuse authentication to escalate privileges and read access keys, secret keys and deployment secrets.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aquila","eaglecloud","infrastructure","on-premises","self-hosted"],"not_affected_if":["managed-hosting","newer-than-2.6.7.2"],"how_to_check":"- Check the installed Aquila version against `2.6.7.2`; unknown whether the sources list a fixed build\n- Confirm whether the tunnel gateway and provisioning interfaces are reachable from the network","fix":"- Upgrade Aquila on-premises to a release later than `2.6.7.2`; unknown exact fixed version\n- Rotate access keys, secret keys and deployment secrets after upgrading, since they may have been exposed","status":"open","published_at":"2026-10-28T05:16:59+00:00","first_seen_at":"2026-10-28T05:31:15+00:00","triaged_at":"2026-10-28T05:32:18+00:00","updated_at":"2026-10-28T05:32:18+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T05:32:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Aquila on-premises to a release later than `2.6.7.2`; unknown exact fixed version\n- Rotate access keys, secret keys and deployment secrets after upgrading, since they may have been exposed","reach":"network","title":"EagleCloud Aquila: unauthenticated attackers reach access keys and deployment secrets","impact":"high","summary":"EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms expose credentials in its tunnel gateway and provisioning interfaces. An unauthenticated remote attacker can abuse authentication to escalate privileges and read access keys, secret keys and deployment secrets.","category":"infrastructure","nicknames":[],"who_cares":["aquila","eaglecloud","on-premises","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker escalates privileges and reads access keys and deployment secrets","analyst_note":"Find the vendor advisory or fixed version for Aquila after 2.6.7.2 and confirm whether the tunnel gateway and provisioning interfaces are on by default.","how_to_check":"- Check the installed Aquila version against `2.6.7.2`; unknown whether the sources list a fixed build\n- Confirm whether the tunnel gateway and provisioning interfaces are reachable from the network","needs_analyst":true,"not_affected_if":["managed-hosting","newer-than-2.6.7.2"],"who_is_affected":"On-premises deployments of EagleCloud Aquila at or below version 2.6.7.2 with the tunnel gateway or provisioning interfaces exposed are affected. Teams running only managed or hosted Aquila, or versions newer than 2.6.7.2, can skip it; unknown whether the sources confirm any default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":3330,"output_tokens":663,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104384':13A,16A '-2026':12A,15A '2.6.7.2':30B,78C 'abus':50B,93C 'access':6A,57B,95C,97C 'allow':84C 'aquila':2A,17B,27B,75C 'attack':4A,48B,87C 'authent':51B,92C 'credenti':37B,66C 'cve':11A,14A 'deploy':9A,62B,102C 'eaglecloud':1A,18B,26B,74C 'escal':53B,89C 'expos':36B 'gateway':41B,69C 'host':25B 'infrastructur':19B 'insuffici':64C 'interfac':44B,72C 'key':7A,58B,60B,98C,100C 'on-premis':20B,32B,80C 'platform':35B,83C 'premis':22B,34B,82C 'privileg':54B,90C 'protect':65C 'provis':43B,71C 'reach':5A 'read':56B 'remot':47B,86C 'secret':10A,59B,63B,99C,103C 'self':24B 'self-host':23B 'tunnel':40B,68C 'unauthent':3A,46B,85C 'version':28B,76C 'via':91C","nicknames":[],"mitigations":[],"who_affected":"On-premises deployments of EagleCloud Aquila at or below version 2.6.7.2 with the tunnel gateway or provisioning interfaces exposed are affected. Teams running only managed or hosted Aquila, or versions newer than 2.6.7.2, can skip it; unknown whether the sources confirm any default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T05:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"mandiant-cve@google.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104384","severity":null,"published_at":"2026-10-28T05:16:59+00:00","modified_at":"2026-10-28T05:16:59+00:00","first_seen_at":"2026-10-28T05:31:15+00:00","fetched_at":"2026-10-28T05:31:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}