CVE-2026-104384

Insufficiently Protected Credentials in the tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access access keys, secret keys, and deployment secrets.

An unauthenticated attacker can obtain critical secrets and keys, potentially enabling full compromise of the environment.

Update EagleCloud Aquila to a version later than 2.6.7.2 or apply the vendor patch, and immediately rotate any exposed keys and secrets.