---
id: "CVE-2026-110474"
kind: "vulnerability"
aliases: ["CVE-2026-110474"]
title: "CreditNirvana Agentic AI Call Centre: hardcoded API key leaks call transcripts"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["agentic-ai", "ai-tooling", "call-centre", "creditnirvana", "javascript", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-10-26T14:16:26+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:32:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110474", "first_seen_at": "2026-10-26T14:30:36+00:00"}]
---

# CreditNirvana Agentic AI Call Centre: hardcoded API key leaks call transcripts

The CreditNirvana Agentic AI Call Centre ships a static API key inside its client-side JavaScript bundle. Anyone who downloads those files can extract the key and call the application API to retrieve call transcripts and recordings.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Download the public client-side JavaScript bundle from the deployed call centre site and search it for API key strings, for example `grep -i "api[_-]key" bundle.js`
- Check whether the key extracted from the bundle still authenticates against the application API
- unknown for the exact affected versions

## Fix

- Rotate the hardcoded API key so the exposed value no longer works
- Move the key to server-side configuration and stop shipping it in client bundles
- unknown for the patched version

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110474

## From the sources

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_