CVE-2026-103098 describes a security issue where a sensitive key is transmitted in the URL over an unencrypted HTTP connection. The lack of encryption means the key is exposed in plaintext on the network, allowing an attacker with network monitoring capabilities to intercept and obtain the key. This vulnerability is classified under CWE-319 (Cleartext Transmission of Sensitive Information). The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

The primary impact is the potential disclosure of a sensitive key to an attacker who can monitor network traffic. This compromises confidentiality but does not affect integrity or availability. The exposure of the key could lead to further unauthorized actions depending on the key's use.

No official patch or remediation guidance is provided in the available data. Since the vulnerability arises from using HTTP instead of HTTPS, the recommended mitigation is to ensure all sensitive keys are transmitted only over encrypted HTTPS connections to protect confidentiality. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.