EUVD-2026-19115Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 5.5 indicates moderate severity with low confidentiality impact (VC:L), several factors elevate real-world risk: the attack vector is network-based with low complexity (AV:N/AC:L), requires no authentication (PR:N), and no user interaction (UI:N). The exploitation probability is marked as 'P' (PoC available) with publicly available exploit code on GitHub. However, the impact is limited to information disclosure without integrity or availability impact (VI:N/VA:N/SI:N/SA:N). The vendor's complete non-response despite early notification suggests no patch timeline exists. SSVC assessment would classify this as 'Attend' rather than 'Critical' due to limited functional impact, but the public exploit availability and remote unauthenticated attack vector create practical exploitation risk for exposed instances. |
| Exploit ScenarioDerived | A remote attacker without authentication or user interaction can send a crafted request to the Task Detail Endpoint via WebSocket to manipulate an unknown function in task_manager.go, triggering information disclosure. A publicly available proof-of-concept exploit is documented on GitHub (https://gist.github.com/YLChen-007/fe4b834144ad535d167507c2008d4011), making it straightforward for an attacker to retrieve sensitive task details or other protected information exposed through the vulnerable endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 05, 2026
Tencent AI-Infra-Guard 4.0 discloses sensitive information through an unknown function in the Task Detail Endpoint (common/websocket/task_manager.go) that can be manipulated by remote, unauthenticated attackers. The vulnerability has a CVSS score of 5.5 with publicly available exploit code, though no patch has been released despite early vendor notification.
RemediationAI
No vendor-released patch has been identified as of this analysis. Users should implement network-level access controls to restrict remote access to the WebSocket Task Detail Endpoint (common/websocket/task_manager.go) if possible. Monitor Tencent's official security advisories for patch releases, though the vendor's non-response suggests remediation timeline is unclear. As an interim measure, disable or isolate the Task Detail Endpoint if not required for critical operations, and implement authentication or IP whitelisting at the network boundary to restrict access to trusted sources only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the WebSocket task management component of Tencent AI-Infra-Guard, specifically within the Task Detail Endpoint handler. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper access controls or data validation in the task_manager.go file. The vulnerability affects version 4.0 and potentially earlier versions based on the CPE wildcard pattern. The WebSocket protocol is used for task communication, and the manipulation of an unknown function within this endpoint allows attackers to access information that should be restricted.
Know when Tencent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
WeKnora LLM framework (before 0.2.5) allows authenticated users to inject MCP stdio commands that the server executes as
OS command injection in WeKnora from version 0.2.5 allows authenticated users to execute arbitrary system commands. CVSS
SQL injection in WeKnora LLM document understanding framework allows authenticated users to extract arbitrary database c
vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions
Insufficient authorization checks in WeKnora's tenant management endpoints allow any authenticated user to read, modify,
Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view
Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subs
Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. Rated high severity (CVSS 8.1), t
In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate poi
HaboMalHunter through 2.0.0.3 in Tencent Habo allows attackers to evade dynamic malware analysis via PIE compilation. Ra
Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.
A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via a
Exploit-DB