PentestGPT CVE-2026-37012

The attacker requires only the ability to read the public PentestGPT GitHub repository, which imposes no authentication or network privilege requirement. For the leaked credentials to yield live data, PentestGPT 1.0.0 must have been deployed with the default Langfuse telemetry integration active - meaning pentestgpt/core/langfuse.py must have been loaded and the hardcoded credentials must have been used to submit at least one telemetry trace. Additionally, the Langfuse project owner must not yet have rotated the compromised API keys; rotation immediately invalidates the hardcoded values and prevents further unauthorized access. Exploitation does not require authentication to PentestGPT, network adjacency, or any user interaction. The sensitive data returned depends on how extensively affected deployments have used PentestGPT and what telemetry content Langfuse was configured to capture.

Despite the CVSS 7.5 score with AV:N/PR:N vector, real-world exploitation requires only the ability to read a public GitHub repository - effectively zero barrier. The primary impact is confidentiality loss on the Langfuse telemetry system, which for a security tool likely contains highly sensitive data including pentest target hostnames, vulnerability findings, and full AI conversation histories. EPSS of 0.22% at the 12th percentile reflects that mass automated exploitation is unlikely given the narrow affected population. No active exploitation is confirmed and no CISA KEV listing exists; no standalone POC is needed given the credential location is publicly documented in a GitHub reference. Any security consultancy or individual practitioner running PentestGPT 1.0.0 with the default Langfuse integration would passively expose client engagement telemetry to anyone who examines the repository. The 'Authentication Bypass' tag in the input is inaccurate and mischaracterizes the vulnerability - this is information disclosure via hardcoded credential exposure, not a bypass of PentestGPT's own authentication mechanism.

An attacker visits the public PentestGPT GitHub repository, navigates to pentestgpt/core/langfuse.py line 114, and copies the hardcoded Langfuse API public and secret key pair. Using the Langfuse SDK or REST API directly, they authenticate to the Langfuse backend as the PentestGPT application and enumerate all recorded telemetry traces, which may include pentest target IP addresses, discovered vulnerabilities, and full AI prompt-response session histories for every user whose telemetry was submitted to that Langfuse project. No access to any victim's PentestGPT instance is required.