PT-2026-67487 · Emlog · Emlog

Ilhomjon Rustamov + 1 · CVE-2026-67598 · Published 2026-08-03 · Updated 2026-08-03

Mitre

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT SSL VERIFYPEER and CURLOPT SSL VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query database and update config tool handlers.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-67598

Affected Products

Emlog

References · 3

• https://github.com/emlog/emlog/security/advisories/GHSA-hf85-99vj-m4c5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-67598 · Security Note
• https://vulncheck.com/advisories/emlog-pro-tls-certificate-validation-disabled-in-ai-php · Note