{"id":"CVE-2026-125377","kind":"vulnerability","aliases":["CVE-2026-125377"],"related":[],"title":"Pig: missing authorization exposes OAuth2 client secrets to any logged-in user","description":"Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.","summary":"Pig before 4.1.2 has a missing authorization check in SysClientController, so any authenticated user without client-management permission can read OAuth2 client secrets through GET /client/{clientId} and GET /client/export. An attacker who gets those secrets can request tokens for the affected clients using their configured grant types.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","oauth2","package","pig","self-hosted","spring"],"not_affected_if":["version-4.1.2-or-later"],"how_to_check":"- Look for the `SysClientController` class and the `/client/{clientId}` and `/client/export` routes in the Pig deployment.\n- Check the Pig version in the project's dependency file; versions below `4.1.2` are affected.","fix":"- Pig: upgrade to `4.1.2` or later.","status":"open","published_at":"2026-11-10T00:17:10+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","triaged_at":"2026-11-10T00:30:14+00:00","updated_at":"2026-11-10T00:30:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T00:30:14Z","model":"claude-haiku-5-5","output":{"fix":"- Pig: upgrade to `4.1.2` or later.","reach":"network","title":"Pig: missing authorization exposes OAuth2 client secrets to any logged-in user","impact":"high","summary":"Pig before 4.1.2 has a missing authorization check in SysClientController, so any authenticated user without client-management permission can read OAuth2 client secrets through GET /client/{clientId} and GET /client/export. An attacker who gets those secrets can request tokens for the affected clients using their configured grant types.","audience":"businesses","category":"package","nicknames":[],"who_cares":["pig","java","spring","oauth2","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Any logged-in user can read client secrets and obtain tokens","analyst_note":"","how_to_check":"- Look for the `SysClientController` class and the `/client/{clientId}` and `/client/export` routes in the Pig deployment.\n- Check the Pig version in the project's dependency file; versions below `4.1.2` are affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-4.1.2-or-later"],"who_is_affected":"Teams running Pig (the Java/Spring-based admin and auth platform) before 4.1.2 where ordinary authenticated users can reach the client endpoints. The sources name the seed clients pig, app and daemon as examples. Deployments that restrict these endpoints to privileged roles at the gateway may be less exposed, but the sources do not say how much that reduces risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4632,"output_tokens":580,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125377':16A,19A '-2026':15A,18A '/client':54B,103C '/client/export':58B,107C '4.1.2':30B,79C 'affect':70B 'allow':88C 'app':118C 'attack':60B,108C 'authent':40B,89C 'author':3A,34B,83C 'check':35B 'client':6A,44B,50B,71B,93C,99C,115C,124C,131C 'client-manag':43B,92C 'clientid':55B,104C 'clientsecret':111C 'configur':74B,132C 'contain':80C 'cve':14A,17A 'daemon':120C 'export':122C 'expos':4A 'fetch':110C 'get':53B,57B,62B,102C,106C 'grant':75B,133C 'host':26B 'java':20B 'like':116C 'log':11A 'logged-in':10A 'manag':45B,94C 'miss':2A,33B,82C 'oauth2':5A,21B,49B,98C 'obtain':127C 'packag':22B 'permiss':46B,95C 'pig':1A,23B,28B,77C,117C 'read':48B 'request':66B 'retriev':97C 'secret':7A,51B,64B,100C 'seed':114C 'self':25B 'self-host':24B 'spring':27B 'sysclientcontrol':37B,86C 'tabl':125C 'token':67B,128C 'type':76B,134C 'use':72B,129C 'user':13A,41B,90C 'valu':112C 'via':101C 'vulner':84C 'without':42B,91C","nicknames":[],"mitigations":[],"who_affected":"Teams running Pig (the Java/Spring-based admin and auth platform) before 4.1.2 where ordinary authenticated users can reach the client endpoints. The sources name the seed clients pig, app and daemon as examples. Deployments that restrict these endpoints to privileged roles at the gateway may be less exposed, but the sources do not say how much that reduces risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","java","oauth2","package","pig","selfhosted","spring"],"campaign_type":null,"search_a":"'-125377':16A,19A '-2026':15A,18A 'author':3A 'client':6A 'cve':14A,17A 'expos':4A 'log':11A 'logged-in':10A 'miss':2A 'oauth2':5A 'pig':1A 'secret':7A 'user':13A","search_b":"'/client':54B '/client/export':58B '4.1.2':30B 'affect':70B 'attack':60B 'authent':40B 'author':34B 'check':35B 'client':44B,50B,71B 'client-manag':43B 'clientid':55B 'configur':74B 'get':53B,57B,62B 'grant':75B 'host':26B 'java':20B 'manag':45B 'miss':33B 'oauth2':21B,49B 'packag':22B 'permiss':46B 'pig':23B,28B 'read':48B 'request':66B 'secret':51B,64B 'self':25B 'self-host':24B 'spring':27B 'sysclientcontrol':37B 'token':67B 'type':76B 'use':72B 'user':41B 'without':42B","search_c":"'/client':103C '/client/export':107C '4.1.2':79C 'allow':88C 'app':118C 'attack':108C 'authent':89C 'author':83C 'client':93C,99C,115C,124C,131C 'client-manag':92C 'clientid':104C 'clientsecret':111C 'configur':132C 'contain':80C 'daemon':120C 'export':122C 'fetch':110C 'get':102C,106C 'grant':133C 'like':116C 'manag':94C 'miss':82C 'oauth2':98C 'obtain':127C 'permiss':95C 'pig':77C,117C 'retriev':97C 'secret':100C 'seed':114C 'sysclientcontrol':86C 'tabl':125C 'token':128C 'type':134C 'use':129C 'user':90C 'valu':112C 'via':101C 'vulner':84C 'without':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125377","severity":null,"published_at":"2026-11-10T00:17:10+00:00","modified_at":"2026-11-10T00:17:10+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","fetched_at":"2026-11-10T00:28:43+00:00","note":null}],"documents":[{"id":111535,"url":"https://github.com/pig-mesh/pig/commit/0fffbf14d393f30a0272a3cdf0a54efd45e0d9e3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111536,"url":"https://github.com/pig-mesh/pig/releases/tag/v4.1.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111537,"url":"https://www.vulncheck.com/advisories/pig-before-4.1.2-missing-authorization-exposes-oauth2-client-secrets-via-client","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}