CVE-2026-37012

HighCVSS 7.5

Published: 27/08/2026(UTC)Updated: 01/09/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

The vulnerability in PentestGPT 1.0.0 in core/langfuse.py allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.

Risk Assessment

Disclosure of telemetry data can violate user privacy and lead to unauthorized access to monitoring systems, which could be exploited for further attacks.

Recommendation

Immediately remove hardcoded credentials from the code, use secure secret storage, and update PentestGPT to the latest version.

Other vulnerabilities in PentestGPT

CVE-2026-76993Medium
A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of the argument Traceback can lead to injection. The attack can be executed remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized.

Original NVD description (English source)

A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS