{"id":"CVE-2026-116105","kind":"vulnerability","aliases":["CVE-2026-116105"],"related":[],"title":"HeyCyan Android app: cleartext network traffic may expose sensitive information","description":"A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"HeyCyan App 1.0.103 for Android has a weakness in its Network Security Configuration in AndroidManifest.xml that allows sensitive information to be sent in cleartext. A remote attacker who positions themselves on the network path could read that data, though the sources say exploitation is highly complex and difficult.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","heycyan","mobile","package"],"not_affected_if":["patched-version","tls-only-traffic"],"how_to_check":"- Decompile or open the app's `AndroidManifest.xml` and check whether `android:usesCleartextTraffic` is set to `true` or a `network_security_config` file permits cleartext domains\n- Check the app's version with the Android package manager; the affected version is `1.0.103`","fix":"- unknown: the sources report no vendor response and no patched version; watch the app's store listing for an update","status":"open","published_at":"2026-10-26T02:17:06+00:00","first_seen_at":"2026-10-26T02:39:11+00:00","triaged_at":"2026-10-26T02:39:36+00:00","updated_at":"2026-10-26T02:39:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T02:39:36Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources report no vendor response and no patched version; watch the app's store listing for an update","reach":"network","title":"HeyCyan Android app: cleartext network traffic may expose sensitive information","impact":"medium","summary":"HeyCyan App 1.0.103 for Android has a weakness in its Network Security Configuration in AndroidManifest.xml that allows sensitive information to be sent in cleartext. A remote attacker who positions themselves on the network path could read that data, though the sources say exploitation is highly complex and difficult.","category":"package","nicknames":[],"who_cares":["android","mobile","heycyan"],"confidence":0.6,"needs_auth":"unknown","worst_case":"sensitive data sent in cleartext can be read by network attackers","analyst_note":"Confirm the exact manifest or network security config change and whether a fixed version exists; the NVD entry is the only source.","how_to_check":"- Decompile or open the app's `AndroidManifest.xml` and check whether `android:usesCleartextTraffic` is set to `true` or a `network_security_config` file permits cleartext domains\n- Check the app's version with the Android package manager; the affected version is `1.0.103`","needs_analyst":true,"not_affected_if":["patched-version","tls-only-traffic"],"who_is_affected":"Users of the HeyCyan Android app version 1.0.103, where the Network Security Configuration appears to permit unencrypted traffic. Teams that run or depend on this app should check whether it sends sensitive data over plain HTTP. Users of other versions or of unrelated apps are not covered by these sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000632,"input_tokens":3354,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116105':13A,16A '-2026':12A,15A '1.0.103':23B,77C 'affect':80C 'allow':37B 'android':2A,17B,25B,79C 'androidmanifest.xml':35B,88C 'app':3A,22B,76C 'attack':47B,107C,113C 'cleartext':4A,44B,101C 'complex':66B,119C 'compon':91C 'configur':33B,94C 'contact':130C 'could':55B 'cve':11A,14A 'data':58B 'difficult':68B,126C 'disclosur':134C 'earli':131C 'execut':95C 'exploit':63B,121C 'expos':8A 'file':87C 'function':84C 'heycyan':1A,18B,21B,75C 'high':65B,116C 'identifi':73C 'inform':10A,39B,105C 'launch':110C 'lead':99C 'level':117C 'manipul':97C 'may':7A 'mobil':19B 'network':5A,31B,53B,92C 'packag':20B 'path':54B 'posit':49B 'read':56B 'remot':46B,111C 'requir':114C 'respond':138C 'say':62B 'secur':32B,93C 'sensit':9A,38B,104C 'sent':42B 'sourc':61B 'though':59B 'told':123C 'traffic':6A 'transmiss':102C 'unknown':83C 'vendor':128C 'way':141C 'weak':28B,70C","nicknames":[],"mitigations":[],"who_affected":"Users of the HeyCyan Android app version 1.0.103, where the Network Security Configuration appears to permit unencrypted traffic. Teams that run or depend on this app should check whether it sends sensitive data over plain HTTP. Users of other versions or of unrelated apps are not covered by these sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T02:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116105","severity":null,"published_at":"2026-10-26T02:17:06+00:00","modified_at":"2026-10-26T02:17:06+00:00","first_seen_at":"2026-10-26T02:39:11+00:00","fetched_at":"2026-10-26T02:39:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}