CVE-2026-37012

Unknown

Published: 27/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Summary

The vulnerability in PentestGPT 1.0.0 in core/langfuse.py allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.

Risk Assessment

Disclosure of telemetry data can violate user privacy and lead to unauthorized access to monitoring systems, which could be exploited for further attacks.

Recommendation

Immediately remove hardcoded credentials from the code, use secure secret storage, and update PentestGPT to the latest version.

Original NVD description (English source)

A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.