Vulnerability-Lookup

CVE-2026-55375 (GCVE-0-2026-55375)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:30 – Updated: 2026-09-15 19:05

Title

canto-saas-api: OAuth credentials exposed in URL query string and exception messages

Summary

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 19:05 UTC

CWE

CWE-209 - Generation of Error Message Containing Sensitive Information
CWE-598 - Use of GET Request Method With Sensitive Query Strings

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/jleehr/canto-saas-api/security…	x_refsource_CONFIRM
https://github.com/jleehr/canto-saas-api/commit/3…	x_refsource_MISC
https://github.com/jleehr/canto-saas-api/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
jleehr	canto-saas-api	Affected: < 3.0.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55375",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T19:05:37.098259Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T19:05:49.862Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "canto-saas-api",
          "vendor": "jleehr",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:30:29.992Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v"
        },
        {
          "name": "https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339"
        },
        {
          "name": "https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-37pm-83g7-r22v",
        "discovery": "UNKNOWN"
      },
      "title": "canto-saas-api: OAuth credentials exposed in URL query string and exception messages"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55375",
    "datePublished": "2026-09-15T17:30:29.992Z",
    "dateReserved": "2026-06-16T18:57:40.181Z",
    "dateUpdated": "2026-09-15T19:05:49.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55375",
      "date": "2026-09-17",
      "epss": "0.00251",
      "percentile": "0.16711"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55375\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-15T18:17:24.087\",\"lastModified\":\"2026-09-15T19:17:22.323\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"jleehr\",\"product\":\"canto-saas-api\",\"versions\":[{\"version\":\"\u003c 3.0.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-15T19:05:37.098259Z\",\"id\":\"CVE-2026-55375\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"},{\"lang\":\"en\",\"value\":\"CWE-598\"}]}],\"references\":[{\"url\":\"https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55375\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-15T19:05:37.098259Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-15T19:05:46.545Z\"}}], \"cna\": {\"title\": \"canto-saas-api: OAuth credentials exposed in URL query string and exception messages\", \"source\": {\"advisory\": \"GHSA-37pm-83g7-r22v\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"jleehr\", \"product\": \"canto-saas-api\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v\", \"name\": \"https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339\", \"name\": \"https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0\", \"name\": \"https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-209\", \"description\": \"CWE-209: Generation of Error Message Containing Sensitive Information\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-598\", \"description\": \"CWE-598: Use of GET Request Method With Sensitive Query Strings\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-15T17:30:29.992Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-55375\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-15T19:05:49.862Z\", \"dateReserved\": \"2026-06-16T18:57:40.181Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-15T17:30:29.992Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55375

Vulnerability from fkie_nvd - Published: 2026-09-15 18:17 - Updated: 2026-09-15 19:17

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339
	security-advisories@github.com	https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0
	security-advisories@github.com	https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "canto-saas-api",
          "vendor": "jleehr",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0."
    }
  ],
  "id": "CVE-2026-55375",
  "lastModified": "2026-09-15T19:17:22.323",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55375",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T19:05:37.098259Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T18:17:24.087",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        },
        {
          "lang": "en",
          "value": "CWE-598"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-37PM-83G7-R22V

Vulnerability from github – Published: 2026-06-19 14:16 – Updated: 2026-06-19 14:16

Summary

canto-saas-api: OAuth credentials exposed in URL query string and exception messages

Details

Summary

In affected versions, the OAuth2 token request sends app_id, app_secret, refresh_token and code as URL query parameters of the POST request to https://oauth.<domain>/oauth/api/oauth2/token. Request URLs are commonly recorded in access logs, proxy logs and APM traces, so the application secret and refresh token can be persisted in plain text outside the application's control.

In addition, when the token request fails, the Guzzle exception message — which contains the full request URI including the credentials — was passed unmodified into the AuthorizationFailedException thrown by OAuth2::obtainAccessToken(). Applications that log exceptions or forward them to error trackers (e.g. Sentry) may therefore have recorded the app secret in their logs.

## Impact

An attacker with access to web server logs, proxy logs, APM tracing data or application error logs of a consumer of this library can obtain the Canto app_secret, refresh_token or authorization code and use them to obtain access tokens for the Canto tenant.

## Patches

Fixed in 3.0.0:

OAuth credentials are sent in the form-encoded POST body instead of the URL query string (RFC 6749 §2.3.1). OAuth2Request::getQueryParams() now returns null; the parameters are available via getFormParams().
Exception messages are sanitized before being rethrown: the values of app_secret, refresh_token and code are masked (including url-encoded, differently cased and JSON-embedded variants).

## Workarounds

If you cannot upgrade:

Treat web server, proxy and APM logs of systems performing Canto OAuth requests as secret material and restrict access to them.
Catch AuthorizationFailedException in your application and strip the query string from the message before logging or forwarding it.

If your logs may have been exposed, rotate the affected Canto app secret.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "jleehr/canto-saas-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55375"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-598"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T14:16:41Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n  In affected versions, the OAuth2 token request sends `app_id`, `app_secret`,\n  `refresh_token` and `code` as URL query parameters of the POST request to\n  `https://oauth.\u003cdomain\u003e/oauth/api/oauth2/token`. Request URLs are commonly\n  recorded in access logs, proxy logs and APM traces, so the application secret\n  and refresh token can be persisted in plain text outside the application\u0027s\n  control.\n\n  In addition, when the token request fails, the Guzzle exception message \u2014\n  which contains the full request URI including the credentials \u2014 was passed\n  unmodified into the `AuthorizationFailedException` thrown by\n  `OAuth2::obtainAccessToken()`. Applications that log exceptions or forward\n  them to error trackers (e.g. Sentry) may therefore have recorded the app\n  secret in their logs.\n\n  ## Impact\n\n  An attacker with access to web server logs, proxy logs, APM tracing data or\n  application error logs of a consumer of this library can obtain the Canto\n  `app_secret`, `refresh_token` or authorization `code` and use them to obtain\n  access tokens for the Canto tenant.\n\n  ## Patches\n\n  Fixed in 3.0.0:\n\n  - OAuth credentials are sent in the form-encoded POST body instead of the URL\n    query string (RFC 6749 \u00a72.3.1). `OAuth2Request::getQueryParams()` now\n    returns `null`; the parameters are available via `getFormParams()`.\n  - Exception messages are sanitized before being rethrown: the values of\n    `app_secret`, `refresh_token` and `code` are masked (including url-encoded,\n    differently cased and JSON-embedded variants).\n\n  ## Workarounds\n\n  If you cannot upgrade:\n\n  - Treat web server, proxy and APM logs of systems performing Canto OAuth\n    requests as secret material and restrict access to them.\n  - Catch `AuthorizationFailedException` in your application and strip the query\n    string from the message before logging or forwarding it.\n\n  If your logs may have been exposed, rotate the affected Canto app secret.",
  "id": "GHSA-37pm-83g7-r22v",
  "modified": "2026-06-19T14:16:41Z",
  "published": "2026-06-19T14:16:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jleehr/canto-saas-api"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "canto-saas-api: OAuth credentials exposed in URL query string and exception messages"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55375 (GCVE-0-2026-55375)

FKIE_CVE-2026-55375

GHSA-37PM-83G7-R22V

Summary

Tags

Sightings

Nomenclature

Related by attack behaviour