EUVD-2026-34811
GHSA-gg86-h3jm-9m46
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can leverage these vulnerabilities to decrypt sensitive obfuscated strings, including ConnectionString values containing database credentials from appsettings.json.
AnalysisAI
Cryptographic weaknesses in the linqi application (versions ≤1.4.8.5) allow local attackers with low-level privileges to decrypt sensitive obfuscated configuration data, including database connection strings stored in appsettings.json. The flaw combines hardcoded cryptographic keys (CWE-321) with a weak, limited-ASCII-charset algorithm for dynamically generating AES/CBC Initialization Vectors, enabling known-plaintext attacks. No public exploit identified at time of analysis, and the CVE is not present in CISA KEV, but the CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact.
Technical ContextAI
linqi is a business process automation platform developed by linqi GmbH, built on the .NET stack (as evidenced by the appsettings.json configuration model). The vulnerability stems from two compounding cryptographic anti-patterns rooted in CWE-321 (Use of Hard-coded Cryptographic Key): first, encryption keys are embedded directly in the application binaries or configuration, meaning every deployment shares the same secret; second, the IVs used with AES in CBC mode are generated using a weak custom algorithm constrained to a limited ASCII character set. Proper AES-CBC requires cryptographically random, unpredictable 16-byte IVs - restricting the IV entropy to printable ASCII drastically reduces the keyspace and, combined with known plaintext patterns common in .NET ConnectionString values (e.g., 'Server=', 'Database=', 'User Id='), makes known-plaintext attacks computationally feasible.
RemediationAI
Upgrade linqi to a version newer than 1.4.8.5 as indicated by the vendor security advisory at https://linqi.help/en/reference/security/security-advisories/#security-advisory-hardcoded-cryptographic-keys-and-weak-iv-generation-in-the-linqi-application; an exact fix version is not explicitly stated in the provided data, so consult the vendor advisory for the latest patched release. After upgrading, rotate all database credentials and any other secrets stored in appsettings.json, since the hardcoded keys mean prior ciphertexts must be assumed compromised. As compensating controls before patching, restrict file-system access to appsettings.json and the linqi application binaries using strict OS-level ACLs (allowing only the service account to read them), enforce least-privilege on the linqi host to prevent low-privilege local users from reading configuration files, and consider moving database credentials out of appsettings.json into a secret manager (Azure Key Vault, HashiCorp Vault) referenced at runtime - note that the latter requires application support and may not be drop-in compatible with all linqi deployments.
An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
An issue was discovered in linqi before 1.4.0.1 on Windows. Rated high severity (CVSS 7.5), this vulnerability is remote
Cross-tenant comment access in linqi BPM platform versions through 1.4.8.5 allows any authenticated user to read and wri
Authentication bypass in linqi's /api/Cdn/GetFile endpoint allows unauthenticated remote attackers to circumvent the Val
An issue was discovered in linqi before 1.4.0.1 on Windows. Rated medium severity (CVSS 5.9), this vulnerability is no a
An issue was discovered in linqi before 1.4.0.1 on Windows. Rated medium severity (CVSS 5.5), this vulnerability is remo
Server-side request forgery in linqi's custom process creation feature allows authenticated attackers to conduct interna
An issue was discovered in linqi before 1.4.0.1 on Windows. Rated medium severity (CVSS 4.8), this vulnerability is low
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today