PT-2026-60791 · Thehive · Thehive

George Chen · CVE-2026-63098 · Published 2026-07-17 · Updated 2026-07-17

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-63098

Affected Products

Thehive

References · 3

• 🔥 https://github.com/geo-chen/oss/blob/main/TheHive.md#finding-1-get-apistatus-exposes-attachment-protection-password-without-authentication · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-63098 · Security Note
• https://vulncheck.com/advisories/thehive-unauthenticated-information-disclosure-via-api-status-endpoint · Note