PT-2026-29008 · Al Ko · Al-Ko Robolinho Update

Piotr Ptaszek · Published 2026-03-30 · Updated 2026-03-30 · CVE-2026-1612

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AL-KO Robolinho Update Software version 8.0.21.0610 versions prior to 8.0.21.0610

Description The AL-KO Robolinho Update Software contains hard-coded AWS Access and Secret keys, potentially granting unauthorized access to AL-KO's AWS bucket. Utilizing these keys directly could provide an attacker with broader access than the application itself. Access granted by these keys includes at least read access to objects within the bucket. The vendor was notified of this issue but did not provide details regarding vulnerable version ranges.

Recommendations Update to version 8.0.21.0610 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-1612

Affected Products

Al-Ko Robolinho Update

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-1612 · Security Note
• https://twitter.com/CVEnew/status/2038618085251301493 · Twitter Post
• https://cert.pl/en/posts/2026/03/CVE-2026-1612 · Note