Uptrace CVE-2026-105707

Exploitation targets the Login function in pkg/org/user_handler.go of uptrace versions up to and including 2.1.0-beta.8; the attacker only needs network reachability to the uptrace login interface, with no authentication (PR:N), no user interaction (UI:N), and no special configuration per the CVSS vector. The concrete prerequisite is simply that the vulnerable uptrace login endpoint is network-exposed and running an affected pre-release build (through 2.1.0-beta.8). Limiting factors: impact is confined to low-severity information disclosure via error messages (no integrity or availability impact), the affected builds are beta/pre-release versions which narrows the exposed population, and no vendor-confirmed patch is yet available, so remediation currently relies on restricting network exposure of the login endpoint.

This is a genuine-but-modest-priority issue, not a high-severity emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely reachable, low-complexity, unauthenticated flaw, which is why it is network-exploitable without prerequisites; however, the only impact is low confidentiality (VC:L, VI:N, VA:N), consistent with CWE-209 information exposure through an error message rather than code execution or full data compromise. Exploitation status is 'publicly available exploit code exists' (POC disclosed via the uptrace GitHub issue tracker); it is NOT in CISA KEV and there is no evidence of active exploitation, so POC availability must not be conflated with in-the-wild use. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap. The CVSS 4.0 string carries E:P (Proof-of-Concept), which aligns with the POC signal. There is no SSVC decision data in the input. Net: a legitimate low-to-medium information-disclosure bug with a public POC but low technical impact and a small deployment footprint, warranting routine rather than emergency patching - tempered by the fact that the vendor was notified via an issue report and has not yet responded, so no official fix is confirmed.

A remote, unauthenticated attacker sends crafted login requests to the uptrace Login endpoint and observes differential or verbose error-message responses that disclose sensitive information (e.g., whether an account exists or internal details), supporting username enumeration or reconnaissance. A public proof-of-concept is referenced in the uptrace GitHub issue tracker (issue #600). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required.