Hardcoded Credentials
Monthly
Hardcoded Langfuse API credentials embedded in PentestGPT 1.0.0's core telemetry module expose all user session telemetry to unauthorized third parties. Any actor who reads the public GitHub repository can extract the literal API key pair from pentestgpt/core/langfuse.py:114 and authenticate directly to the Langfuse observability backend, gaining read access to pentest session traces that may contain targets, findings, and full AI prompt-response histories. No public exploit or CISA KEV listing exists, though the source reference functionally serves as exploit documentation; EPSS is 0.22% at the 12th percentile.
LightRAG's JWT authentication can be bypassed via a hardcoded default secret 'lightrag-jwt-default-secret' when TOKEN_SECRET is not configured. Unauthenticated attackers can forge valid tokens to access protected API endpoints in installations running v1.4.10 with AUTH_ACCOUNTS enabled but TOKEN_SECRET unset. CVSS 7.5 (High) reflects network-accessible confidentiality breach with no authentication required. No public exploit identified at time of analysis, though the hardcoded secret is publicly documented in the vulnerability disclosure. EPSS data not available for this CVE.
Hardcoded Langfuse API credentials embedded in PentestGPT 1.0.0's core telemetry module expose all user session telemetry to unauthorized third parties. Any actor who reads the public GitHub repository can extract the literal API key pair from pentestgpt/core/langfuse.py:114 and authenticate directly to the Langfuse observability backend, gaining read access to pentest session traces that may contain targets, findings, and full AI prompt-response histories. No public exploit or CISA KEV listing exists, though the source reference functionally serves as exploit documentation; EPSS is 0.22% at the 12th percentile.
LightRAG's JWT authentication can be bypassed via a hardcoded default secret 'lightrag-jwt-default-secret' when TOKEN_SECRET is not configured. Unauthenticated attackers can forge valid tokens to access protected API endpoints in installations running v1.4.10 with AUTH_ACCOUNTS enabled but TOKEN_SECRET unset. CVSS 7.5 (High) reflects network-accessible confidentiality breach with no authentication required. No public exploit identified at time of analysis, though the hardcoded secret is publicly documented in the vulnerability disclosure. EPSS data not available for this CVE.