CVE-2026-0397
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
When the internal webserver is enabled (default is disabled), an attacker might trick an administrator into visiting a malicious website and extract configuration information. The root cause is a misconfigured CORS policy.
Risk Assessment
Risk of leaking sensitive configuration data through a social engineering attack on the administrator.
Recommendation
Ensure the internal webserver is disabled if not needed. If enabled, configure the CORS policy correctly.
Original NVD description (English source)
When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.