CVE-2026-39908 describes a credential disclosure vulnerability in OpenBullet2 (up to version 0.3.2) on Windows. The issue arises when a job proxy source is configured with a UNC path referencing an attacker-controlled server. Upon job execution, OpenBullet2 attempts to load proxies from this UNC path, triggering an SMB authentication attempt that leaks the NTLMv2 hash of the process user. This hash disclosure can be exploited by attackers to perform relay attacks or offline cracking. The vulnerability is remotely exploitable without user interaction and requires low attack complexity. No vendor advisory or patch information is currently provided.

The vulnerability allows remote attackers to obtain the NTLMv2 hash of the user running OpenBullet2, potentially enabling credential relay or offline cracking attacks. This could lead to unauthorized access if the hash is successfully exploited. The CVSS score of 7.1 reflects a high impact due to credential disclosure and the potential for privilege escalation or lateral movement. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid configuring job proxy sources with UNC paths pointing to untrusted or attacker-controlled servers. Restricting network access to trusted hosts and monitoring proxy source configurations may reduce risk.