Chronosphere Chronocollector CVE-2026-0239

The attacker must have adjacent network access (AV:A) to the host running Chronosphere Chronocollector - this means being on the same broadcast domain, VLAN, or directly connected subnet. Internet-based exploitation is not possible without prior network pivot. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any deployment of Chronocollector versions prior to v0.116.0 that is reachable from an adjacent network segment is exploitable without credentials. There are no known non-default configuration prerequisites mentioned in available data. Exploitation is constrained solely by the adjacent network requirement, meaning exposure is highest in flat network architectures where monitoring agents share segments with untrusted hosts.

The CVSS 4.0 base score of 4.9 (Medium) appropriately reflects the adjacent-only attack vector (AV:A), which meaningfully constrains real-world exploitability compared to a fully remote vulnerability. Confidentiality impact on the vulnerable component is rated High (VC:H) with no integrity or availability impact. The CVSS 4.0 supplemental modifier V:C (Value Density: Concentrated) elevates concern, suggesting exposed data may be high-value. Countering this, the EPSS score of 0.02% at the 6th percentile indicates very low exploitation probability based on historical patterns. SSVC confirms Exploitation: none, Automatable: no (consistent with the adjacent-network constraint), and Technical Impact: partial. The Exploit Maturity modifier E:U (Unreported) aligns with no known public exploit. The CVSS urgency rating of Amber and response effort of Moderate suggest a planned patching cadence is appropriate rather than emergency response. Overall, this is a genuine but bounded risk: organizations should patch to v0.116.0 but need not treat this as a critical emergency absent evidence of targeting.

An attacker who has gained a foothold on the same network segment as a Chronosphere Chronocollector instance - for example, via a compromised host in a monitoring VLAN - sends an unauthenticated HTTP request to the collector's service endpoint. The service responds with sensitive information without requiring credentials, potentially exposing internal configuration, credentials, or telemetry metadata. No public exploit code has been identified at time of analysis, but the low complexity (AC:L, AT:N) suggests exploitation requires no special skill once network proximity is achieved.