Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

SecObserve before 1.59.1 reveals scanner passwords via API

CVE-2026-92759 · published 1 month ago
Summary

Versions of SecObserve older than 1.59.1 return the clear‑text password used for scanner or integration services when the API configuration is requested. Users who only have view access can see these passwords, which could let an attacker impersonate those services. Update SecObserve to version 1.59.1 or later to stop the passwords from being exposed.

What to do
  • Update secobserve secobserve to version 1.59.1 or later.
Affected software
VendorProductAffected versions
secobserve secobserve < 1.59.1
Original advisory text
SecObserve before 1.59.1 Information Disclosure via API Configuration
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published16 Sep 2026
Updated4 Nov 2026
First seen16 Sep 2026
Sources
CVE-2026-92759 · NVD
CVE-2026-92759 · MITRE
CVE-2026-92759 · OSV
GHSA-r968-78vw-jj9m · GHSA
Track software like this
Free during beta