CVE-2026-10078

Katalog CVE KUTIM-CSIRT

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-10078

Katalog CVE

CVSS 2.7 · Low EPSS 0,20%

Kerentanan Use of HTTP Request With Sensitive Query String. Skor CVSS 3.1 2.7 (Low) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these credentials in various system logs, such as server access logs, reverse proxy logs, and other monitoring systems. An attacker with access to these logs could potentially obtain these credentials, leading to unauthorized information disclosure.

Rincian

Terbit di NVD
29 Mei 2026
Terakhir diubah
21 Juli 2026
Status NVD
Awaiting Analysis
CVSS 3.1
2.7 (Low), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-598: Use of HTTP Request With Sensitive Query String
EPSS (30 hari)
0,20% peluang dieksploitasi; lebih tinggi dari 8,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.