{"id":"CVE-2026-110474","kind":"vulnerability","aliases":["CVE-2026-110474"],"related":[],"title":"CreditNirvana Agentic AI Call Centre: hardcoded API key leaks call transcripts","description":"This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.","summary":"The CreditNirvana Agentic AI Call Centre ships a static API key inside its client-side JavaScript bundle. Anyone who downloads those files can extract the key and call the application API to retrieve call transcripts and recordings.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agentic-ai","ai-tooling","call-centre","creditnirvana","javascript","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Download the public client-side JavaScript bundle from the deployed call centre site and search it for API key strings, for example `grep -i \"api[_-]key\" bundle.js`\n- Check whether the key extracted from the bundle still authenticates against the application API\n- unknown for the exact affected versions","fix":"- Rotate the hardcoded API key so the exposed value no longer works\n- Move the key to server-side configuration and stop shipping it in client bundles\n- unknown for the patched version","status":"open","published_at":"2026-10-26T14:16:26+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:12+00:00","updated_at":"2026-10-26T14:32:12+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-26T14:32:12Z","model":"claude-haiku-5-5","output":{"fix":"- Rotate the hardcoded API key so the exposed value no longer works\n- Move the key to server-side configuration and stop shipping it in client bundles\n- unknown for the patched version","reach":"internet","title":"CreditNirvana Agentic AI Call Centre: hardcoded API key leaks call transcripts","impact":"high","summary":"The CreditNirvana Agentic AI Call Centre ships a static API key inside its client-side JavaScript bundle. Anyone who downloads those files can extract the key and call the application API to retrieve call transcripts and recordings.","category":"ai-tooling","nicknames":[],"who_cares":["creditnirvana","agentic-ai","call-centre","javascript","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads call transcripts and recordings through the application API","analyst_note":"Confirm affected versions and patched release from the NVD entry and vendor notice; sources give no fix version.","how_to_check":"- Download the public client-side JavaScript bundle from the deployed call centre site and search it for API key strings, for example `grep -i \"api[_-]key\" bundle.js`\n- Check whether the key extracted from the bundle still authenticates against the application API\n- unknown for the exact affected versions","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Any deployment of the CreditNirvana Agentic AI Call Centre whose client-side JavaScript contains the static API key is exposed, because the key is reachable by anyone who loads the page. Teams running the product should check their own deployed bundles. unknown whether any other configuration can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":3354,"output_tokens":608,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110474':14A,17A '-2026':13A,16A 'agent':2A,19B,34B,76C 'agentic-ai':18B 'ai':3A,20B,22B,35B,77C 'ai-tool':21B 'anyon':50B 'api':7A,41B,63B,85C,109C,117C,128C 'applic':62B,80C,127C 'arbitrari':116C 'attack':96C 'bundl':49B,92C 'call':4A,10A,25B,36B,60B,66B,78C,118C,121C 'call-centr':24B 'centr':5A,26B,37B,79C 'client':46B,89C,103C 'client-sid':45B 'could':97C,112C 'creditnirvana':1A,27B,33B,75C 'cve':12A,15A 'download':52B,102C 'due':81C 'exist':72C 'exploit':98C 'extract':56B,108C 'file':54B,106C 'hardcod':6A,83C 'host':31B 'insid':43B 'javascript':28B,48B,91C,105C 'key':8A,42B,58B,86C,110C 'lead':113C 'leak':9A 'make':115C 'record':69B,124C 'remot':95C 'retriev':65B,120C 'self':30B 'self-host':29B 'ship':38B 'side':47B,90C,104C 'static':40B,84C 'system':132C 'target':131C 'tool':23B 'transcript':11A,67B,122C 'unauthent':94C 'vulner':71C,100C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of the CreditNirvana Agentic AI Call Centre whose client-side JavaScript contains the static API key is exposed, because the key is reachable by anyone who loads the page. Teams running the product should check their own deployed bundles. unknown whether any other configuration can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vdisclose@cert-in.org.in","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110474","severity":null,"published_at":"2026-10-26T14:16:26+00:00","modified_at":"2026-10-26T14:21:33+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}