Threats affecting pkg:github/kameleo-io/kameleo

CVE-2026-116283 is an information disclosure vulnerability in Kameleo versions 5.0.1.0 through 5.0.1.19. The flaw exists in the Local API component, specifically in the /profiles file, and can be exploited remotely. Upgrading to version 5.2.0 mitigates this issue.

CVE-2026-116281 is an information disclosure vulnerability in Kameleo versions 5.0.1.0 through 5.0.1.19 affecting the ListProfiles function in the Profile Controller component. The vulnerability allows local attackers to access sensitive information. This issue is resolved by upgrading to version 5.2.0.

Kameleo versions up to 5.0.1.19 contain a server-side request forgery (SSRF) vulnerability in the InternalController.TestProxy function of the Proxy Validation component. This vulnerability allows remote attackers to manipulate host and port arguments to induce SSRF. The issue is addressed in version 5.2.0, where the vulnerable route was removed and replaced.