sar2html CVE-2026-110667

Exploitation requires that a sar2html 4.0.0 instance using the hard-coded SECRET_KEY in sar2html.py is deployed and network-reachable; the key is static and identical across all installations, so any attacker who reads the public GitHub source can derive it. Limiting factors: the attack is only meaningful where the SECRET_KEY is actually used to sign sessions/tokens, and realistic impact depends on the instance being exposed and in active use - the CVSS impacts are rated Low, so this yields partial compromise (session/credential manipulation) rather than full system takeover. The chief practical limiter is the product's rarity and the absence of a vendor-supplied fixed version.

This is a medium-severity issue (CVSS 4.0 base 6.9) whose real-world priority is LOW despite the network attack vector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated reachability, but the vulnerable-system impacts are only Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L) with no subsequent-system impact (SC/SI/SA:N), which tempers the score. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The flaw is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The vendor has not responded to the issue report (GitHub issue #19), meaning no patch is confirmed available. The dominant mitigating factor is the product itself: sar2html is an obscure open-source hobby utility with negligible enterprise footprint, so even a trivially exploitable hard-coded-credential flaw represents targeted, opportunistic risk at most rather than a widespread threat. Treat as low priority unless this specific tool is known to be deployed and internet-exposed in your environment.

An attacker who inspects the public sar2html.py source extracts the hard-coded SECRET_KEY and uses it to forge or tamper with signed session data against any deployed instance, enabling authentication bypass or session manipulation. Because the key is static and shared across all installations, the attack works remotely without credentials. No public exploit code is referenced, but exploitation requires only reading the open-source repository.