Live › vulnerability › CVE-2026-116282
Go to dashboardKameleo up to version 5.3.1 has a flaw in the CookieController.ListCookies function, where manipulating the guid argument discloses information. An attacker who can reach the affected component remotely can read data it should not expose, such as stored browser cookies.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Teams running Kameleo up to and including version 5.3.1 where the Cookie Controller component is reachable over the network. The sources do not say which deployment setups expose it, and the vendor has not responded to the disclosure.
No product ranges from the sources yet.
5.3.1 or earlierEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116282")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.