GPT-Load CVE-2026-108754

Exploitation requires that GPT-Load's Gin Logger access-logging be active (default behavior) AND that the attacker has read access to one of two specific sinks: the console/stdout log stream or the on-disk file ./data/logs/app.log. The exposed secret only appears for Gemini-style requests that pass the proxy key in the URL query string, because the Gin Logger middleware records the raw query string before extractAuthKey removes the key parameter. Limiting factors: this is local/log-read access only (AV:L), so a remote unauthenticated attacker cannot reach it directly; the attacker must already be an operator, log-pipeline consumer, or host-level intruder (PR:L), and only proxy keys actually used in Gemini-style query-string requests are recoverable - keys sent via headers are not exposed.

This is a genuinely low-priority issue despite being a real, verified flaw. The CVSS 4.0 base vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 4.8 (Medium) and tells a consistent story: exploitation is local, requires some existing privilege (PR:L), and yields only limited confidentiality impact (VC:L) with no integrity or availability impact (VI:N/VA:N). The limiting factor is the precondition - an attacker must already have read access to the console logs or the ./data/logs/app.log file, which means they are already an authenticated operator, log-pipeline consumer, or someone who has otherwise breached the host. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit code is identified in the provided references (the hackmd and VulnCheck links are vulnerability write-ups/advisories, not weaponized PoC). There is no signal conflict to reconcile: every source points the same low-risk direction. The realistic concern is privilege escalation/lateral movement - a user with log visibility but no key access can harvest proxy keys and abuse the corresponding group - rather than mass remote exploitation. Treat as a defense-in-depth / secrets-hygiene fix, not an emergency patch.

An operator, SRE, or log-aggregation user who can read GPT-Load's console output or ./data/logs/app.log reviews the Gin access logs and finds Gemini-style request URLs whose raw query string still contains the client proxy key (logged before extractAuthKey strips it). They copy a leaked key and replay requests against the matching group to consume quota or access upstream LLM APIs as that client. No public exploit code is identified at time of analysis; exploitation is trivial manual log inspection requiring local/log read access (AV:L, AC:L).