---
id: "CVE-2026-70555"
page: "https://infrastack.ai/live/CVE-2026-70555"
kind: "vulnerability"
aliases: ["CVE-2026-70555"]
title: "rConfig Core: device-credentials API leaks plaintext SSH and Telnet passwords to users"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "rConfig Core", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["network-devices", "other", "rconfig", "ssh", "telnet"]
not_affected_if: ["rconfig-pro", "version-8.2.13-or-later"]
published_at: "2026-11-09T19:17:05+00:00"
first_seen_at: "2026-11-09T19:28:21+00:00"
updated_at: "2026-11-09T19:30:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70555", "first_seen_at": "2026-11-09T19:28:21+00:00"}]
exploit_sources: []
---

# rConfig Core: device-credentials API leaks plaintext SSH and Telnet passwords to users

Link for people: https://infrastack.ai/live/CVE-2026-70555 (this .md is for agents)

rConfig Core 8.2.3 before 8.2.13 decrypts stored device credentials on read and does not check authorization on the device-credentials API. An authenticated user can retrieve cleartext SSH, Telnet and enable passwords for every managed device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:rConfig Core affected range not listed fixed no fixed version listed

## How to check

- Check the installed rConfig Core version against the fixed range `8.2.13`
- Confirm the product is Core and not Pro, since the sources say Pro is not affected

## Fix

- rConfig Core: move to `8.2.13` or later

## Timeline

- 2026-11-09T19:28:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-70555

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/rconfig-core-cleartext-credential-exposure-via-api
- [fix] Patch: github.com https://github.com/rconfig/rconfig/commit/090d4481acaf0003a33581eeb486a540414ff806
- [fix] Release notes: github.com https://github.com/rconfig/rconfig/releases/tag/core-8.2.13

## From the sources

rConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices through the device-credentials API due to automatic decryption on read and missing authorization checks. Attackers can request GET /api/device-credentials, GET /api/device-credentials/{id}, or the external GET /api/v1/device-credentials endpoint, which authenticates any valid token as the seeded administrator account, to statelessly exfiltrate all stored plaintext device credentials. rConfig Pro is not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_