CVE-2026-54554

Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in FOG Project Prior to 1.5.10.1870

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-54554

EUVD

EUVD-2026-101520

Affected Vendors & Products

Vendor	Product	Version / Range
FOGProject	fogproject	< 1.5.10.1870

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-54554 is a vulnerability in FOGProject where the adInfo() endpoint exposes the plaintext Active Directory default join password (FOG_AD_DEFAULT_PASSWORD) in JSON responses. This occurs because the endpoint returns sensitive credentials without proper authorization checks. The issue affects versions prior to 1.5.10.1870 and can be exploited both unauthenticated via node=ipxe and through authenticated UI flows.

Detection Guidance

To detect this vulnerability, check if your FOGProject version is prior to 1.5.10.1870. Run: grep -r "FOG_AD_DEFAULT_PASSWORD" /var/www/html/fog/lib/fog/ or check the FOG version with: grep "FOG_VERSION" /var/www/html/fog/lib/fog/system.class.php. If the version is below 1.5.10.1870, the system is vulnerable.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to obtain the default domain-join credential, which could be used to join systems to the Active Directory domain. It also exposes sensitive information through the management interface, potentially aiding further attacks.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA due to the exposure of Active Directory default join credentials. GDPR requires protection of personal data, and HIPAA mandates safeguarding sensitive health information credentials. Unauthorized access to domain-join passwords risks unauthorized access to systems handling regulated data.

Mitigation Strategies

Upgrade FOGProject to version 1.5.10.1870 or later immediately. Apply the patch from the official release or GitHub commit. Ensure the adInfo() function enforces authentication and removes sensitive password fields from responses.

Hi! I’m here to help you understand CVE-2026-54554. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70