PT-2026-67487 · Emlog · Emlog

Ilhomjon Rustamov + 1 · CVE-2026-67598 · Publicado 2026-08-03 · Atualizado 2026-08-03

Mitre

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT SSL VERIFYPEER and CURLOPT SSL VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query database and update config tool handlers.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-67598

Produtos afetados

Emlog

Referências · 3

• https://github.com/emlog/emlog/security/advisories/GHSA-hf85-99vj-m4c5 · Aviso do Fabricante
• https://vulncheck.com/advisories/emlog-pro-tls-certificate-validation-disabled-in-ai-php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-67598 · Nota de Segurança