Which versions of Djangoblog are affected by CVE-2026-6580?

DjangoBlog versions up to 2.1.0.0 contain hard-coded API credentials in source code that enable attackers to abuse geolocation services at scale without authentication, potentially inflating API…

Is there a public PoC exploit available for CVE-2026-6580?

Yes, a public proof-of-concept exploit is available for CVE-2026-6580. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6580?

Within 24 hours: Identify all DjangoBlog instances running versions ≤2.1.0.0 using deployment inventory and version scanning; rotate all Amap API keys immediately and monitor API usage for anomalies. Within 7 days: Implement network-level restrictions on Amap API calls (rate limiting, IP whitelisting, request signing); audit logs for unauthorized API access correlating with CVE publication date. Within 30 days: Upgrade to DjangoBlog version >2.1.0.0 if available, or migrate to an alternative blog platform; conduct code review of all hard-coded credentials across codebase.

Djangoblog CVE-2026-6580

Q: What is the CVSS score of CVE-2026-6580?

CVE-2026-6580 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23714 MEDIUM

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-19 VulDB

GHSA-xf7j-p5gh-45hr

Information Disclosure Djangoblog Liangliangyy

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 19, 2026 - 23:22 NVD

HIGH MEDIUM

CVSS changed

Apr 19, 2026 - 23:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 19, 2026 - 22:35 vuln.today

EUVD ID Assigned

Apr 19, 2026 - 22:30 euvd

EUVD-2026-23714

Analysis Generated

Apr 19, 2026 - 22:30 vuln.today

CVE Published

Apr 19, 2026 - 22:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A security vulnerability has been detected in liangliangyy DjangoBlog up to 2.1.0.0. Affected is an unknown function of the file owntracks/views.py of the component Amap API Call Handler. Such manipulation of the argument key leads to use of hard-coded cryptographic key . The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Hard-coded Amap API key exposure in DjangoBlog allows remote attackers to abuse geolocation services without authentication. DjangoBlog versions up to 2.1.0.0 embed a fixed cryptographic key in owntracks/views.py for Amap API calls, enabling unauthorized API usage with low confidentiality, integrity, and availability impact. Publicly available exploit code exists (POC=YES). EPSS data not provided. Not listed in CISA KEV. Vendor unresponsive to disclosure.

Technical ContextAI

DjangoBlog is a Django-based blogging platform. The owntracks component integrates with Amap (AutoNavi/Gaode Maps), a Chinese mapping service similar to Google Maps. The vulnerability (CWE-321: Use of Hard-coded Cryptographic Key) occurs when API credentials are embedded directly in source code rather than externalized to configuration files or environment variables. The hard-coded Amap API key in owntracks/views.py allows anyone with read access to the code repository or deployed application to extract the key and make unauthorized API calls against the developer's Amap account. This violates API key rotation best practices and creates persistent credential exposure. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the key is network-accessible without authentication, though actual exploitation requires the attacker to obtain the source code (commonly public in open-source projects). The low CIA impact (C:L/I:L/A:L) reflects API quota abuse, potential geolocation data exposure, and service disruption through rate-limit exhaustion rather than direct system compromise.

RemediationAI

No vendor-released patch identified at time of analysis due to maintainer non-responsiveness. Users must implement manual remediation: (1) Remove hard-coded API key from owntracks/views.py and replace with environment variable or secrets management (e.g., Django settings with os.getenv('AMAP_API_KEY')). (2) Regenerate the Amap API key through the Amap developer console to invalidate the exposed credential. (3) Implement API key rotation policy and restrict key permissions to minimum required scopes (IP whitelisting if Amap supports). (4) If owntracks/Amap functionality is unused, disable or remove the owntracks component entirely to eliminate attack surface (trade-off: loss of geolocation tracking features). (5) Monitor Amap API usage for anomalous activity indicating key abuse. For deployment teams unable to modify code, firewall rules blocking outbound connections to Amap API endpoints from the Django application can prevent key usage, though this breaks legitimate owntracks functionality. Reference the POC at https://github.com/3em0/cve_repo/blob/main/DjangoBlog/Vuln-5-Hardcoded-Amap-API-Key.md for technical details to validate your remediation.