PT-2026-40829 · Unknown · Hoppscotch

Published 2026-05-13 · Updated 2026-05-14 · CVE-2026-44478

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions hoppscotch versions prior to 2026.4.0

Description An information disclosure issue exists where the 'GET /v1/onboarding/config' endpoint leaks infrastructure secrets in plaintext to unauthenticated users. This occurs specifically when the ONBOARDING RECOVERY TOKEN stored in the database is an empty string.

Recommendations Update to version 2026.4.0.

Exploit

Fix

Improper Authentication

Improper Access Control

Weakness Enumeration

CWE-287

CWE-284

Related Identifiers

CVE-2026-44478

Affected Products

Hoppscotch

References · 5

• 🔥 https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7c8p-hj4p-3q3f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44478 · Security Note
• https://twitter.com/VulmonFeeds/status/2054780953600430277 · Twitter Post
• https://t.me/CVEtracker/53726 · Telegram Post
• https://twitter.com/CVEnew/status/2054709184697082334 · Twitter Post