{"id":"CVE-2026-112168","kind":"vulnerability","aliases":["CVE-2026-112168"],"related":[],"title":"Magistra software: weak custom encryption and embedded secrets in database","description":"The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets.","summary":"The Magistra software protects its database with custom encryption that is weak and uses an outdated compression algorithm. It also contains embedded secrets, so an attacker who obtains the code or data may be able to decrypt stored content.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["magistra","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T13:17:04+00:00","first_seen_at":"2026-11-09T13:26:49+00:00","triaged_at":"2026-11-09T13:27:42+00:00","updated_at":"2026-11-09T13:27:42+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-09T13:27:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Magistra software: weak custom encryption and embedded secrets in database","impact":"medium","summary":"The Magistra software protects its database with custom encryption that is weak and uses an outdated compression algorithm. It also contains embedded secrets, so an attacker who obtains the code or data may be able to decrypt stored content.","audience":"businesses","category":"other","nicknames":[],"who_cares":["magistra"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker decrypts stored database contents using embedded secrets","analyst_note":"Identify affected Magistra versions, vendor advisory and any fixed release at https://nvd.nist.gov/vuln/detail/CVE-2026-112168.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected Magistra versions or deployment conditions. Teams running Magistra to store data should check with their vendor or NVD for affected versions and whether the database protection applies to them.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000663,"input_tokens":4495,"output_tokens":426,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112168':13A,16A '-2026':12A,15A 'abl':52B 'algorithm':35B,69C 'also':37B 'attack':43B 'code':47B 'compress':34B,68C 'contain':38B,75C 'content':56B 'custom':4A,25B,62C 'cve':11A,14A 'data':49B 'databas':10A,23B,73C 'decrypt':54B 'embed':7A,39B,76C 'encrypt':5A,26B,63C 'magistra':1A,17B,19B,58C 'may':50B 'obtain':45B 'outdat':33B,67C 'protect':21B,71C 'reli':64C 'secret':8A,40B,77C 'softwar':2A,20B,59C 'store':55B 'use':31B,60C 'weak':3A,29B,61C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected Magistra versions or deployment conditions. Teams running Magistra to store data should check with their vendor or NVD for affected versions and whether the database protection applies to them.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["magistra","medium","other"],"campaign_type":null,"search_a":"'-112168':13A,16A '-2026':12A,15A 'custom':4A 'cve':11A,14A 'databas':10A 'embed':7A 'encrypt':5A 'magistra':1A 'secret':8A 'softwar':2A 'weak':3A","search_b":"'abl':52B 'algorithm':35B 'also':37B 'attack':43B 'code':47B 'compress':34B 'contain':38B 'content':56B 'custom':25B 'data':49B 'databas':23B 'decrypt':54B 'embed':39B 'encrypt':26B 'magistra':17B,19B 'may':50B 'obtain':45B 'outdat':33B 'protect':21B 'secret':40B 'softwar':20B 'store':55B 'use':31B 'weak':29B","search_c":"'algorithm':69C 'compress':68C 'contain':75C 'custom':62C 'databas':73C 'embed':76C 'encrypt':63C 'magistra':58C 'outdat':67C 'protect':71C 'reli':64C 'secret':77C 'softwar':59C 'use':60C 'weak':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112168","severity":null,"published_at":"2026-11-09T13:17:04+00:00","modified_at":"2026-11-09T13:17:04+00:00","first_seen_at":"2026-11-09T13:26:49+00:00","fetched_at":"2026-11-09T13:26:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}