EUVD-2026-96928
GHSA-9c5c-2g3c-vxv8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Viper instance or Docker image
-
ExploitAccess exposed /root/viper/.git/config
-
ExecutionExtract hard-coded credentials
-
ImpactReuse secrets against linked services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires access to the /root/viper/.git/config file in a FunnyWolf Viper deployment (versions up to 3.1.11), where git credentials are hard-coded/embedded - per the advisory, left inside the distributed Docker image. The realistic prerequisite is obtaining the affected Docker image or reaching an environment/web path that exposes the .git directory. Limiting factors: impact is confined to disclosure of whatever credentials are stored in that git config (CVSS confidentiality LOW only, no integrity/availability impact), the product is a niche security tool with small deployment, and the stated AV:N remote vector is unconfirmed against the local file path - if the .git directory is not web-exposed, practical exploitation reduces to attackers who can already pull or access the image. |
| Impact | This is a low-to-moderate priority issue despite its remote attack vector. The input CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:L/VI:N/VA:N) describes an unauthenticated, network-reachable flaw with only LOW confidentiality impact and no integrity or availability impact, consistent with CWE-798 (hard-coded credentials) leaking via an exposed /root/viper/.git/config file - the referenced advisory frames this as a Docker image git-credential leak. Exploitation maturity is E:P (proof-of-concept) and a public exploit exists, but there is NO EPSS score provided in the input and NO CISA KEV listing, so there is no evidence of widespread or automated exploitation - this points to opportunistic/targeted interest rather than mass exploitation. A key conflict to verify: the vector claims AV:N (remote/network) yet the affected element is a local filesystem path (/root/viper/.git/config), which typically implies either local image/container access or a web-exposed .git directory; the VulDB-sourced description is vague on the exact exposure mechanism - verify with the GitHub advisory and vendor. Net: real but bounded risk, driven by credential disclosure rather than direct code execution. |
| Exploit ScenarioDerived | An attacker obtains or reaches a Viper deployment (e.g., pulls the public Docker image or accesses an environment where the .git/config is reachable) and reads /root/viper/.git/config, which contains hard-coded/embedded credentials. A public proof-of-concept exploit has been released, lowering the skill needed to locate and extract the leaked secrets, which could then be reused against the associated git repository or related services. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Hard-coded git credentials embedded in the distributed Docker image of FunnyWolf Viper up to and including version 3.1.11 are recoverable from the file /root/viper/.git/config, granting whoever obtains the image - or reaches a deployment that exposes the .git directory - access to the secrets stored there. Publicly available exploit code exists, published alongside a GitHub advisory and a VulDB submission, so the technique is trivially reproducible; there is no CISA KEV entry, so confirmed active exploitation in the wild is not established. With CVSS 4.0 scoring 5.5 (AV:N/PR:N/UI:N) but only LOW confidentiality impact and no integrity or availability effect, this is best treated as a low-to-moderate credential-disclosure issue rather than a pre-authentication remote compromise.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so remediation is operational and must be performed by anyone running an affected image. Treat the credential in /root/viper/.git/config as compromised first: revoke and rotate the corresponding git host token or password (and any other secret that file exposes) before anything else, since removing the file after the image has been pulled or mirrored does not undo the disclosure. Then rebuild images without version-control metadata - add .git to .dockerignore, avoid cloning the repository into the image layer in the first place, and use multi-stage builds or a shallow tarball copy so no .git directory exists at /root/viper/; the trade-off is that in-image git metadata, sometimes used for version stamping, must be replaced by an explicit build argument or environment variable. Supply git credentials at build time through BuildKit secrets or a credential helper instead of embedding them in remote URLs, since secrets passed as ARG/ENV land in image history just as visibly. Where images cannot be rebuilt immediately, block access to /.git/ paths at the reverse proxy (nginx/Apache deny rules) and restrict registry and image pull permissions to trusted operators - effective against the network-vector scenario but useless against an attacker who can already pull the image, which the independent assessment calls the realistic prerequisite. Finally, audit existing deployments with image scanners or a simple docker run --rm -it <image> ls /root/viper/.git check to determine which hosts are actually affected, and monitor the git host for use of the leaked token. Cross-reference https://vuldb.com/vuln/416236 and the GitHub advisory for any later vendor fix before closing out.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-798 (Use of Hard-coded Credentials). Git stores per-repository configuration in .git/config, and that file commonly retains a remote URL of the form https://user:token@host/org/repo.git or a credential helper entry when the repository was cloned or pushed to inside the build environment. In Viper's case, the .git directory was shipped inside the Docker image under /root/viper/, meaning the credential is baked into an immutable image layer that anyone pulling or inspecting the image can read - and that may additionally be readable over HTTP if the application's web root or a reverse-proxy misconfiguration exposes /.git/ paths. The underlying technology chain is therefore Docker image build hygiene plus git remote configuration, not a memory-safety or injection defect: no parsing bug, no privilege boundary crossing, just an artifact that should never have been committed to a release image. The CPE cpe:2.3:a:funnywolf:viper:*:*:*:*:*:*:*:* enumerates all Viper releases, and the advisory scope confirms versions up to 3.1.11 are affected. Note the discrepancy between the supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:L, no scope change) and the independent CVSS 3.1 assessment (also PR:N, C:L only): both agree the impact is limited to information disclosure of whatever credential material sits in that file, and both assume the remote vector is realizable, which the assessment flags as unconfirmed if the .git directory is not actually network-reachable.
Know when Viper gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Unauthenticated read of credentials from an exposed git config yields low confidentiality disclosure only; no integrity or availability impact, PR:N since no auth is needed to fetch the file.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB