PT-2026-46913 · Linqi · Linqi

Ianis Bernard · CVE-2026-11347 · Published 2026-06-05 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions linqi (affected versions not specified)

Description The application contains hardcoded cryptographic keys and employs a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption. This implementation makes known-plaintext attacks feasible, where an attacker can deduce the plaintext by comparing it with the ciphertext. An attacker with local access can decrypt sensitive obfuscated strings, such as ConnectionString values containing database credentials located in the appsettings.json file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-321

CWE-338

Related Identifiers

CVE-2026-11347

Affected Products

Linqi

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-11347 · Security Note
• https://linqi.help/en/reference/security/security-advisories/#security-advisory-hardcoded-cryptographic-keys-and-weak-iv-generation-in-the-linqi-application · Vendor Advisory
• https://linqi.help/en/reference/security/security-advisories/#security-advisory-hardcoded-cryptographic-keys-and-weak-iv-generation-in-linqi · Vendor Advisory
• https://t.me/CVEtracker/55951 · Telegram Post