Gpt Load
Monthly
Cleartext logging in GPT-Load through 1.4.11 exposes client proxy keys for Gemini-style requests, because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Anyone able to read the console/stdout stream or the on-disk ./data/logs/app.log - an operator, a log-pipeline consumer, or a host-level intruder with low-privileged local access (PR:L) - can recover those keys and replay them against the corresponding group. The assessed impact is confidentiality-only and low (CVSS 4.8; assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), exploitation requires default access logging to be active and keys to be sent in the query string rather than headers, and no public exploit identified at time of analysis.
Cleartext logging in GPT-Load through 1.4.11 exposes client proxy keys for Gemini-style requests, because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Anyone able to read the console/stdout stream or the on-disk ./data/logs/app.log - an operator, a log-pipeline consumer, or a host-level intruder with low-privileged local access (PR:L) - can recover those keys and replay them against the corresponding group. The assessed impact is confidentiality-only and low (CVSS 4.8; assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), exploitation requires default access logging to be active and keys to be sent in the query string rather than headers, and no public exploit identified at time of analysis.