---
id: "CVE-2026-116282"
kind: "vulnerability"
aliases: ["CVE-2026-116282"]
title: "Kameleo: Cookie Controller flaw lets remote callers read cookie data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["browser-automation", "kameleo", "package"]
not_affected_if: []
published_at: "2026-10-26T14:16:35+00:00"
first_seen_at: "2026-10-26T14:30:37+00:00"
updated_at: "2026-10-26T14:32:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116282", "first_seen_at": "2026-10-26T14:30:37+00:00"}]
---

# Kameleo: Cookie Controller flaw lets remote callers read cookie data

Kameleo up to version 5.3.1 has a flaw in the CookieController.ListCookies function, where manipulating the guid argument discloses information. An attacker who can reach the affected component remotely can read data it should not expose, such as stored browser cookies.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kameleo version and whether it is `5.3.1` or earlier
- unknown

## Fix

- unknown

## Timeline

- 2026-10-26T14:30:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116282

## From the sources

A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_