CVE-2026-108754: Insertion of Sensitive Information into Log File in tbphp gpt-load

The vulnerability in tbphp gpt-load (versions up to 1.4.11) involves the Gin Logger middleware logging the raw query string containing client proxy keys before the extractAuthKey function removes the key parameter. This results in sensitive proxy keys being written in cleartext to console logs or the ./data/logs/app.log file. An attacker with read access to these logs can recover the proxy keys from Gemini-style requests and potentially use them against the associated group.

Exposure of client proxy keys in log files can lead to unauthorized use of these keys by attackers who have read access to the logs. This compromises the confidentiality of authentication credentials and may allow attackers to impersonate legitimate clients or access protected resources associated with the proxy keys.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to log files to trusted personnel only and consider disabling or modifying logging of sensitive query parameters to prevent exposure of proxy keys.