A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded… (CVE-2026-37012)

CVE-2026-37012 is a vulnerability in PentestGPT 1.0.0 specifically in the pentestgpt/core/langfuse.py file. The issue arises from hardcoded API credentials embedded in the source code, which can be exploited by remote attackers to access sensitive user telemetry data. This exposure compromises confidentiality but does not affect integrity or availability. The vulnerability requires no privileges or user interaction and can be exploited remotely over the network. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

The vulnerability allows remote attackers to access sensitive telemetry data collected by PentestGPT due to hardcoded API credentials. This results in a confidentiality breach of user data. There is no indication of impact on data integrity or system availability. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid deploying PentestGPT 1.0.0 in sensitive environments or restrict network access to mitigate exposure. Monitor vendor channels for updates or patches addressing this issue.