SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-37012

HIGH · CVSS 7.5 EPSS 0.36% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-27 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

A vulnerability in the langfuse.py module of PentestGPT 1.0.0 enables remote attackers to access sensitive user telemetry data due to hardcoded API credentials. Organizations utilizing this version of PentestGPT should prioritize remediation to prevent unauthorized data exposure. Immediate action is recommended for those handling sensitive information or relying on this tool for security assessments.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-37012
Severity
HIGH
CVSS
7.5
EPSS
0.36%

Original NVD Description

A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.