PT-2026-24097 · Unknown · Keygraph Shannon

Valentin Lobstein · Published 2026-03-09 · Updated 2026-05-01 · CVE-2026-29023

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Keygraph Shannon (affected versions not specified)

Description Keygraph Shannon contains a hard-coded API key within its router configuration. When the router component is enabled and accessible, network attackers can use this publicly known key to authenticate. An attacker reaching the router port can proxy requests through the Shannon instance, utilizing the victim’s upstream provider API credentials. This can lead to unauthorized API usage and potential exposure of data within proxied requests and responses. The general exploitability of this issue has been mitigated with commit 023cc95. The affected API endpoint is the router configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-29023

Affected Products

Keygraph Shannon

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-29023 · Security Note
• https://github.com/KeygraphHQ/shannon/pull/224/changes/023cc953db742602964b7826105278d15c28a420 · Note
• https://github.com/KeygraphHQ/shannon/pull/224 · Note
• https://github.com/KeygraphHQ/shannon/issues/186 · Note
• https://vulncheck.com/advisories/keygraph-shannon-hard-coded-router-api-key · Note
• https://t.me/cveNotify/161737 · Telegram Post
• https://t.me/CVEtracker/46930 · Telegram Post
• https://twitter.com/CVEnew/status/2031122523958493353 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2031177117476549075 · Twitter Post
• https://twitter.com/cyberbivash/status/2031104845457813832 · Twitter Post