PT-2026-23642 · Openshift · Openshift

Mdavis · Published 2026-03-06 · Updated 2026-03-06 · CVE-2026-28675

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSift versions prior to 1.6.3-alpha

Description OpenSift is an AI study tool that uses semantic search and generative AI to analyze large datasets. Prior to version 1.6.3-alpha, certain API endpoints returned raw exception strings to clients, potentially exposing sensitive implementation details. Additionally, login token material was exposed in the user interface and token rotation output. The vulnerable endpoints include those that handle exceptions and token management. The exposed token material includes information related to user authentication. The token is exposed in UI responses and token rotation output.

Recommendations Update to version 1.6.3-alpha or later.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-209

CWE-200

Related Identifiers

CVE-2026-28675

GHSA-667G-RVCJ-W976

Affected Products

Openshift

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28675.json · Exploit
• https://github.com/OpenSift/OpenSift/commit/de99b9c · Patch
• https://github.com/OpenSift/OpenSift/security/advisories/GHSA-667g-rvcj-w976 · Patch
• https://github.com/OpenSift/OpenSift/commit/1126e0a503876056a68a434e19f64158a5a4840b · Patch
• https://github.com/OpenSift/OpenSift/pull/67 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28675 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28675 · Vendor Advisory
• https://github.com/OpenSift/OpenSift/releases/tag/v1.6.3-alpha · Note
• https://t.me/CVEtracker/46545 · Telegram Post