CVE-2026-37012: n/a

CVE-2026-37012 describes a vulnerability in PentestGPT 1.0.0 where hardcoded API credentials in the pentestgpt/core/langfuse.py file can be exploited by remote attackers to access sensitive user telemetry data. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials). The CVSS v3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. There is no known exploit in the wild and no vendor advisory or patch information is provided.

An attacker can remotely exploit this vulnerability without authentication to disclose sensitive user telemetry data, potentially compromising user privacy and confidentiality. There is no impact on integrity or availability reported. The vulnerability arises from hardcoded API credentials, which can be extracted and abused by attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to vulnerable components and monitor for unusual data access patterns. Avoid deploying PentestGPT 1.0.0 in sensitive environments without additional compensating controls.