EUVD-2026-25717Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
9DescriptionCVE.org
A vulnerability was detected in 666ghj MiroFish up to 0.1.2. The impacted element is an unknown function of the file /console of the component Werkzeug Debugger PIN Handler. Performing a manipulation of the argument SECRET results in information disclosure. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Information disclosure in MiroFish up to version 0.1.2 allows remote attackers to leak sensitive data through manipulation of the SECRET argument in the Werkzeug Debugger PIN Handler at the /console endpoint. The vulnerability requires high attack complexity and has a low CVSS score (3.7) indicating limited confidentiality impact, but publicly available exploit code exists and the vendor has not responded to early notification.
Technical ContextAI
MiroFish integrates Werkzeug, a Python web framework library that includes a debugger interface. The Werkzeug Debugger PIN Handler is a component responsible for validating debugger access through a PIN mechanism stored in the SECRET parameter. The vulnerability stems from improper information disclosure (CWE-200) in how this handler processes or exposes the SECRET argument, allowing attackers to extract sensitive configuration or authentication data. The /console endpoint appears to be the exposed debugging interface that triggers this issue. The attack surface is network-accessible but requires knowledge of specific parameters and deliberate manipulation, hence the high attack complexity (AC:H) rating.
RemediationAI
Upgrade MiroFish to a version released after 0.1.2 if available; however, the vendor has not responded to the early notification, so a patched release may not yet exist. As an immediate compensating control, disable or restrict access to the /console endpoint in production environments - remove the debugger route entirely or implement network-level access controls (firewall rules, VPN requirement) to allow only internal administrative access from specific IP ranges. Do not expose the Werkzeug debugger interface to untrusted networks. If MiroFish must remain at version 0.1.2, apply a reverse proxy rule to block requests to /console from non-administrative networks. Verify that the SECRET parameter is not logged or exposed in error messages. Monitor the MiroFish GitHub repository (https://github.com/666ghj/MiroFish/) for security updates; contributors should open an issue referencing CVE-2026-7041 to prompt vendor attention.
Remote command injection in MiroFish versions up to 0.1.2 allows unauthenticated attackers to execute arbitrary system c
Missing authentication in MiroFish REST API allows remote attackers to bypass security controls and access protected end
Path traversal in MiroFish up to version 0.1.2 allows remote unauthenticated attackers to read arbitrary files via manip
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today