Live › vulnerability › CVE-2026-117472
Go to dashboardPsono Server versions 4.0.33 through 7.2.3 check the wrong path for the bulk-secret-read endpoint when URL_PREFIX is set, so the read-scope check is skipped. An authenticated attacker holding an API key with write but not read permission can retrieve encrypted secret data and nonces.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 06:25 UTC. All times on this page are UTC.
Only deployments that set URL_PREFIX are affected, because the hard-coded unprefixed path comparison fails there. The attacker must hold an authenticated API key with write permission and read permission disabled, which is an unusual configuration. Default installations without URL_PREFIX are not affected.
No product ranges from the sources yet.
URL_PREFIX is set in the Psono server configuration.4.0.33 through 7.2.3.7.2.3, per the advisory (fixed version unknown from sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-117472")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.