PT-2025-53619 · Actiontec · Actiontech Sqle

28Hus · Published 2025-12-27 · Updated 2026-01-17 · CVE-2025-15107

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions actiontech sqle versions up to 4.2511.0

Description A security issue has been identified in actiontech sqle. The issue resides in an unknown function within the sqle/utils/jwt.go file of the JWT Secret Handler component. Manipulation of the JWTSecretKey argument results in the use of a hard-coded cryptographic key. This issue is remotely exploitable and is considered difficult to exploit. The vulnerability has been publicly disclosed.

Recommendations actiontech sqle versions up to 4.2511.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-320

CWE-798

Related Identifiers

CVE-2025-15107

GHSA-43H9-HC38-QPH5

GO-2025-4269

SUSE-SU-2026:0142-1

Affected Products

Actiontech Sqle

References · 51

• 🔥 https://github.com/actiontech/sqle/issues/3186 · Exploit
• 🔥 https://github.com/actiontech/sqle/milestone/53 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2026:0142-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4269 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-43h9-hc38-qph5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15107 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15107 · Vendor Advisory
• https://github.com/actiontech/sqle/blob/4714f83f33e0d7aa647036eb756e928aa4174014/sqle/utils/jwt.go#L9 · Note
• https://github.com/actiontech/sqle · Note
• https://twitter.com/CVEnew/status/2004934257358372922 · Twitter Post
• https://suse.com/security/cve/CVE-2024-6717 · Note
• https://suse.com/security/cve/CVE-2025-62877 · Note
• https://suse.com/security/cve/CVE-2026-22703 · Note
• https://t.me/cveNotify/146932 · Telegram Post
• https://suse.com/security/cve/CVE-2017-18900 · Note