What is the CVSS score of CVE-2026-2237?

CVE-2026-2237 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-2237?

Yes, a patch is available for CVE-2026-2237. Update the affected software to the latest version immediately.

Synology Storage Manager CVE-2026-2237

EUVD-2026-32153 MEDIUM

Use of GET Request Method With Sensitive Query Strings (CWE-598)

2026-05-27 security@synology.com

GHSA-5v68-527q-prqv

Synology Information Disclosure

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:21 vuln.today

Patch available

May 27, 2026 - 19:46 EUVD

DescriptionCVE.org

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local attackers to obtain sensitive information.

AnalysisAI

Volume encryption in Synology Storage Manager before version 1.0.1-1100 transmits sensitive data via HTTP GET query strings, exposing encryption-related secrets to local attackers who can access web server logs, browser history, or other locally readable URL artifacts. The flaw (CWE-598) requires no privileges or user interaction beyond local system presence, and carries a High confidentiality impact rating because credentials or passphrases associated with volume encryption may be recoverable from logged GET requests. No public exploit exists and EPSS sits at the 1st percentile, indicating no widespread exploitation activity at time of analysis.

Technical ContextAI

CWE-598 (Use of GET Request Method with Sensitive Query Strings) describes a design flaw where sensitive parameters are appended to HTTP GET request URLs rather than transmitted via POST body with appropriate protections. In this case, the volume encryption subsystem within Synology Storage Manager - software that manages storage volumes on Synology NAS devices - passes sensitive data (likely encryption passphrases or key material) as URL query parameters. These values persist in DSM web server access logs, browser history files, HTTP proxy caches, referrer headers, and operating system process tables that are often readable by local users. The local attack vector (AV:L) confirms exploitation is constrained to artifacts accessible from within the host system. No CPE string was provided in the intelligence data; affected scope per EUVD-2026-32153 is all Storage Manager versions below 1.0.1-1100.

RemediationAI

Upgrade Synology Storage Manager to version 1.0.1-1100 or later, as confirmed by the vendor patch advisory at https://www.synology.com/en-global/security/advisory/Synology_SA_26_01 (reported by security@synology.com). As a compensating control prior to patching, administrators should audit and restrict local read access to DSM web server log directories, since these logs may already contain sensitive query strings captured during prior volume encryption operations. Rotating any volume encryption passphrases or key material that may have been transmitted via GET requests before the fix is also recommended, particularly on systems with multiple local user accounts. Disabling volume encryption entirely is not a viable workaround as it would introduce a greater security regression than the vulnerability itself.