disconf CVE-2026-75338

Exploitation requires only network reachability to a disconf 2.6.36 config center; the four endpoints (/api/config/item, /api/config/file, /api/config/list, /api/config/simple/list) are unauthenticated by design of the LoginInterceptor whitelist, so no credentials, tokens, user interaction, or special client configuration are needed against a default 2.6.36 deployment. The primary limiting factor is exposure and footprint: the attacker must be able to reach the disconf API (internet-facing or attacker on the same internal network), and the value of the compromise depends on what secrets a given deployment stores in its configs. There is no version-specific or feature-flag prerequisite beyond running the affected disconf build with these endpoints served.

The raw CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H) overstates direct impact: the described behavior is unauthenticated read of configuration, which is a confidentiality breach, not integrity or availability loss, so the I:H/A:H components are not supported by the description and my independent assessment is 7.5 (confidentiality-only). That said, the exposure is genuinely serious because leaked configs typically contain downstream credentials that enable follow-on compromise, and SSVC flags it as Automatable=yes with Technical Impact=total, meaning it can be trivially and reliably mass-scanned. The tension in the signals is that EPSS is low (0.17%, 6th percentile) and there is no KEV listing, so this is not confirmed as broadly weaponized yet - but a public PoC exists and the attack is a single unauthenticated GET, so any operator running disconf should treat it as high priority regardless of the modest EPSS. In short: high-CVSS with a real, easily automated exploitation path, tempered only by the niche footprint of the product and absence of confirmed active exploitation.

An attacker discovers an internet-exposed disconf instance and issues an unauthenticated GET to /api/config/list to enumerate managed applications, then pulls /api/config/file and /api/config/item to dump full configuration contents including embedded database credentials and API keys. A public PoC/write-up exists, and given AV:N/AC:L/PR:N the attacker needs no account, no user interaction, and only a single HTTP request per endpoint, making the harvested secrets immediately usable for lateral movement into backend systems.