Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-52493: PagerDuty Runbook stores configuration secrets in webpage source code

CVE-2025-52493 · published 10 months ago

Summary

If an administrative user has access to the configuration page in PagerDuty Runbook, they can easily view sensitive secrets by using browser tools. This could lead to unauthorized access to sensitive information. Update to a newer version of PagerDuty Runbook to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
pagerduty	runbook_automation	<= 2025-06-12 `cpe:2.3:a:pagerduty:runbook_automation::::::::`

Original advisory text

PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as password fields, the actual secret values are present in the page source and can be revealed by simply modifying the input field type from "password" to "text" using browser developer tools. This vulnerability is exploitable by administrative users who have access to the configuration page.

References

https://github.com/carterross2/Vulnerability-Research/tree/main/CVE-2025-52493 Third Party Advisory
https://www.pagerduty.com/platform/automation/ Product
https://www.pagerduty.com/security/disclosure/ Product
https://www.praetorian.com Not Applicable

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published10 Dec 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-52493 · NVD

Track software like this

Free during beta