PT-2026-23642 · Openshift · Openshift

Mdavis · Publicado 2026-03-06 · Atualizado 2026-03-06 · CVE-2026-28675

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSift versions prior to 1.6.3-alpha

Description OpenSift is an AI study tool that uses semantic search and generative AI to analyze large datasets. Prior to version 1.6.3-alpha, certain API endpoints returned raw exception strings to clients, potentially exposing sensitive implementation details. Additionally, login token material was exposed in the user interface and token rotation output. The vulnerable endpoints include those that handle exceptions and token management. The exposed token material includes information related to user authentication. The token is exposed in UI responses and token rotation output.

Recommendations Update to version 1.6.3-alpha or later.

Exploit

Correção

Generation of Error Message Containing Sensitive Information

Information Disclosure

Enumeração de Fraquezas

CWE-209

CWE-200

Identificadores relacionados

CVE-2026-28675

GHSA-667G-RVCJ-W976

Produtos afetados

Openshift

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28675.json · Exploit
• https://github.com/OpenSift/OpenSift/commit/de99b9c · Correção
• https://github.com/OpenSift/OpenSift/security/advisories/GHSA-667g-rvcj-w976 · Correção
• https://github.com/OpenSift/OpenSift/releases/tag/v1.6.3-alpha · Nota
• https://github.com/OpenSift/OpenSift/commit/1126e0a503876056a68a434e19f64158a5a4840b · Correção
• https://github.com/OpenSift/OpenSift/pull/67 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-28675 · Nota de Segurança
• https://t.me/CVEtracker/46545 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-28675 · Aviso do Fabricante