PT-2026-35202 · Unknown · Smythos Sre

Eric-B · Published 2026-04-26 · Updated 2026-04-26 · CVE-2026-7021

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SmythOS sre versions prior to 0.0.16

Description A weakness in the Connector Service component, specifically within the packages/sdk/src/LLM/utils.ts file, allows for remote information disclosure. This occurs through the manipulation of the baseURL argument in an unspecified function.

Recommendations Update SmythOS sre to a version later than 0.0.15. As a temporary workaround, restrict or monitor the use of the baseURL argument within the Connector Service to minimize the risk of information disclosure.

Exploit

Fix

Information Disclosure

Improper Access Control

Weakness Enumeration

CWE-200

CWE-284

Related Identifiers

CVE-2026-7021

Affected Products

Smythos Sre

References · 8

• 🔥 https://gist.github.com/YLChen-007/3d35e0ce8197989ee4de4a93def30d47 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7021 · Security Note
• https://twitter.com/VulmonFeeds/status/2048294737925313015 · Twitter Post
• https://twitter.com/CVEarity/status/2048379456163893488 · Twitter Post
• https://vuldb.com/vuln/359600 · Note
• https://vuldb.com/vuln/359600/cti · Note
• https://twitter.com/CVEnew/status/2048481052977422682 · Twitter Post
• https://vuldb.com/submit/797642 · Note