Which versions of cve-search are affected by CVE-2026-59509?

The cve-search platform contains a critical vulnerability enabling unauthenticated attackers to extract administrative credentials directly from the application database.. A patch is available.

Is there a public PoC exploit available for CVE-2026-59509?

Yes, a public proof-of-concept exploit is available for CVE-2026-59509. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-59509?

Within 24 hours: Apply vendor patch for CVE-2026-59509 or take cve-search offline. Within 7 days: Enforce password resets for all administrative users and audit account access logs. Within 30 days: Complete security audit of access patterns, rotate service credentials, and implement database-level access controls.

cve-search CVE-2026-59509

Q: What is the CVSS score of CVE-2026-59509?

CVE-2026-59509 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41753 CRITICAL

Improper Input Validation (CWE-20)

2026-07-05 CIRCL

GHSA-3fmp-59v6-4qw2

Information Disclosure Cve Search

9.2

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Remote unauthenticated read with no interaction (AV:N/AC:L/PR:N/UI:N); reading a separate credential store beyond the app's own data justifies S:C with C:H and no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 13:02 vuln.today

DescriptionCVE.org

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.

AnalysisAI

Arbitrary MongoDB collection disclosure in cve-search allows a remote, unauthenticated attacker to read any application database collection through the POST /fetch_cve_data endpoint by manipulating the collection name, projected fields, and regex filter parameters. Attackers can dump the mgmt_users collection to harvest administrative usernames and password hashes for offline cracking. Publicly available exploit code exists (referenced in the project issue tracker) and a vendor patch is available, though no active exploitation has been reported.

Technical ContextAI

cve-search is an open-source tool from CIRCL that imports CVE, CPE and related security feeds into a local MongoDB backend and exposes a web/API layer for querying them. The flaw is a CWE-20 Improper Input Validation issue: the /fetch_cve_data endpoint passes user-controlled values straight into MongoDB query construction, letting the caller dictate which collection is queried, which fields are projected, and which regular-expression filters are applied. Because no allow-list constrains the target collection, the query engine can be pointed at internal collections such as mgmt_users rather than only CVE data - a NoSQL query-parameter injection that turns a read API into a general database read primitive. The affected component is cpe:2.3:a:cve-search:cve-search across all versions prior to the fix.

RemediationAI

Apply the upstream fix from pull request https://github.com/cve-search/cve-search/pull/1218 by updating to the patched cve-search build (an exact release version is not enumerated in the input, so pull the fixed commit/latest release from the project). Because a public exploit exists, treat rotation of any potentially exposed administrative credentials as part of remediation: reset all mgmt_users passwords and invalidate existing admin sessions after patching, since hashes may already have been captured. Until the patch is deployed, restrict network exposure of the service - bind it to localhost or place it behind an authenticating reverse proxy and firewall the /fetch_cve_data endpoint so it is reachable only from trusted management hosts; the trade-off is reduced accessibility for legitimate API consumers. Do not rely on input filtering as an interim control, as the root cause is server-side collection/field selection that a WAF cannot reliably distinguish from valid queries.