Which versions of Emlog Pro are affected by CVE-2026-67598?

Emlog Pro versions 2.6.23 and earlier contain a critical credential theft vulnerability in the AI integration module where disabled TLS validation exposes LLM provider API keys to network…

How to fix or mitigate CVE-2026-67598?

Within 24 hours, inventory all Emlog Pro deployments running version 2.6.23 or earlier with AI integration enabled and document the configured LLM provider endpoints and estimated data exposure window. Within 7 days, immediately revoke and regenerate all LLM provider API keys and Authorization Bearer tokens associated with Emlog Pro instances, review all LLM provider audit logs for suspicious API calls (particularly those triggering query_database and update_config handlers), and implement network segmentation restricting Emlog Pro outbound HTTPS traffic to only explicitly configured LLM provider endpoints. Within 30 days, monitor Emlog Pro vendor security advisories for patches and prepare for immediate upgrade if available; concurrently, implement permanent interim controls including disabling AI integration features entirely or deploying a reverse proxy with TLS certificate validation between Emlog Pro and external LLM providers.

Emlog Pro CVE-2026-67598

Q: What is the CVSS score of CVE-2026-67598?

CVE-2026-67598 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52405 CRITICAL

Improper Certificate Validation (CWE-295)

2026-08-03 VulnCheck

GHSA-j63f-h5jj-qrf5

PHP Code Injection Emlog

9.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

MITM needs an adjacent on-path position (AV:A, AC:H) but no app credentials (PR:N); stolen API keys give C:H and forged tool-call responses give I:H, with no availability impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 20:06 vuln.today

CVE Published

Aug 03, 2026 - 19:02 cve.org

CRITICAL 9.1

DescriptionCVE.org

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query_database and update_config tool handlers.

Articles & Coverage 1

News Critical TLS Validation Bypass in Emlog Pro 2.6.23 - CVE-2026-67598 Aug 04, 2026

AnalysisAI

Man-in-the-middle credential theft and AI-response injection affects Emlog Pro through 2.6.23, where the AI integration module (include/service/ai.php) unconditionally disables TLS certificate validation on every outbound HTTPS call to configured LLM providers. A network-adjacent attacker who can intercept this traffic can present any TLS certificate to harvest the Authorization Bearer API keys sent with each AI request and to forge LLM responses that feed the automated tool-call pipeline, including the query_database and update_config handlers. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.1 reflects the high confidentiality and integrity impact.

Technical ContextAI

This is a textbook CWE-295 (Improper Certificate Validation) defect in PHP cURL usage. Across the sendStream(), sendImageRequest(), send(), and fetchSearchHtml() functions, the code sets CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to disabled and exposes no switch to re-enable them, so the client accepts any certificate - self-signed or attacker-controlled - for HTTPS connections to external LLM providers (typically OpenAI-compatible chat/completions and image endpoints). With verification off, the channel still encrypts against passive eavesdroppers but no longer authenticates the server, collapsing TLS's defense against an active on-path adversary. The affected component is the AI service layer of Emlog Pro, a PHP-based blogging/CMS platform (CPE cpe:2.3:a:emlog:emlog), and the impact is amplified because forged AI output is parsed and executed by an automated tool-call pipeline rather than merely displayed to a user.

RemediationAI

No exact vendor-released fix version is identified in the available data; monitor the vendor advisory at https://github.com/emlog/emlog/security/advisories/GHSA-hf85-99vj-m4c5 and upgrade to the first release above 2.6.23 that restores certificate validation once it is published. Until a patched release is confirmed, the highest-value compensating control is to re-enable TLS verification directly in include/service/ai.php by setting CURLOPT_SSL_VERIFYPEER to true and CURLOPT_SSL_VERIFYHOST to 2 in sendStream(), sendImageRequest(), send(), and fetchSearchHtml() and pointing CURLOPT_CAINFO at a valid CA bundle (side effect: calls to endpoints with invalid or self-signed certs will now fail, which is the intended behavior). If code changes are not feasible, restrict outbound egress so AI traffic traverses only a trusted, monitored path - for example route LLM calls through a forward proxy that enforces certificate pinning, or disable the AI integration feature entirely (trade-off: loss of AI functionality) - and rotate any LLM provider API keys that may have transited an untrusted network. See the VulnCheck advisory at https://www.vulncheck.com/advisories/emlog-pro-tls-certificate-validation-disabled-in-ai-php for further detail.