Live › vulnerability › CVE-2026-116281
Go to dashboardKameleo up to version 5.0.1.26 has a flaw in the ListProfiles function of its Profile Controller that lets a manipulated request disclose information. An attacker needs local access to the machine to exploit it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Teams that run Kameleo up to version 5.0.1.26 on a machine where other users or processes can reach the local client engine. The sources describe only a local attack path, so systems with no local untrusted access carry less risk. unknown whether the flaw is reachable in any other configuration.
No product ranges from the sources yet.
5.0.1.26; versions up to and including that are affected.5.2.0, which the sources say addresses this issue.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses this issue. Upgrading the affected component is recommended.
This page as .md · .json · in your agent: get_signal("CVE-2026-116281")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.