Which versions of Open ISES Tickets are affected by EUVD-2026-31321?

Open ISES Tickets versions before 3.44.2 expose database credentials in a publicly accessible configuration file, enabling direct database compromise for any user with source code access.. A patch is available.

How to fix or mitigate EUVD-2026-31321?

Within 24 hours: Rotate all MySQL database credentials used by Open ISES Tickets; restrict database network access to the application server only; enable database connection logging. Within 7 days: Upgrade all instances to Open ISES Tickets version 3.44.2 or later. Within 30 days: Audit database access logs from the exposure period; verify no unauthorized connections or data modifications occurred.

Open ISES Tickets EUVD-2026-31321

Q: What is the CVSS score of EUVD-2026-31321?

EUVD-2026-31321 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-48241 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-21 VulnCheck

GHSA-3m3w-vxfv-jm2w

PHP Authentication Bypass

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:30 vuln.today

Analysis Generated

May 21, 2026 - 18:30 vuln.today

Severity Changed

May 21, 2026 - 18:22 NVD

HIGH CRITICAL

CVSS changed

May 21, 2026 - 18:22 NVD

8.1 (HIGH) 9.2 (CRITICAL)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.

AnalysisAI

Hardcoded MySQL credentials in Open ISES Tickets before 3.44.2 expose database username, password, and database name through a public-facing loader.php utility that was committed to the source repository. Any user able to read the source tree on GitHub or fetch the file from a deployed installation can connect to the backing database if reachable, leading to full read/write access. No public exploit identified at time of analysis, but the credentials are trivially recoverable from the source tree.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing/mapping application typically deployed alongside MySQL or MariaDB (release notes confirm testing against MariaDB 10.6/10.11/11.7 and MySQL 5.7/8.0). The flaw is a textbook CWE-798 (Use of Hard-coded Credentials): loader.php - a utility script that is web-accessible - embeds the database username, password, and schema name directly in source. Because the file lives in the public source repository (github.com/openises/tickets), the credentials are recoverable from version-control history even if a deployer rotates the file locally, and they are also retrievable over HTTP from any installation that serves the file. Release v3.44.2 explicitly notes removal of five hardcoded secrets including API keys and database passwords.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets 3.44.2 or later, which removes the hardcoded secrets (commit ecfeb406a016766cae81c749e14b5145a9f2dbff). Docker users can run 'docker compose pull && docker compose up -d'; traditional installs should extract the 3.44.2 zip over the existing tree and run the installer in Upgrade mode per https://github.com/openises/tickets/releases/tag/v3.44.2. Because the credentials are already public in git history, after patching you must rotate the MySQL username, password, and ideally the database name, and audit MySQL logs for unauthorized connections. As compensating controls until patched, restrict loader.php at the web server (e.g., a deny rule for /loader.php in Apache/nginx) which will break the loader utility but blocks remote file disclosure, and bind MySQL to 127.0.0.1 or firewall port 3306 to non-application hosts - this prevents external use of leaked credentials but breaks any remote DB clients you legitimately use.