CVE-2026-1958
Hardcoded Credentials in KlinikaXP Enable Malicious Update Upload
Publication date: 2026-03-23
Last updated on: 2026-03-23
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bri | klinikaxp | to 5.39.01.01 (exc) |
| bri | klinikaxp_insertino | to 3.1.0.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-1958 is a vulnerability in the KlinikaXP and KlinikaXP Insertino software caused by the use of hard-coded credentials. These credentials allowed unauthorized attackers to access several internal services, including the FTP server that hosts the application's update packages."}, {'type': 'paragraph', 'content': 'An attacker with these credentials could upload a malicious update file, which would then be distributed and installed on client machines as if it were a legitimate update, potentially compromising those systems.'}, {'type': 'paragraph', 'content': 'The issue affects KlinikaXP versions before 5.39.01.01 and KlinikaXP Insertino versions before 3.1.0.1. Mitigation involved removing the hard-coded credentials from the code and rotating previously exposed credentials to prevent further attacks.'}] [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to internal services of the KlinikaXP software, including the FTP server that distributes application updates.
An attacker exploiting this vulnerability could upload malicious update files that would be installed on client machines as trusted updates, potentially compromising the security and integrity of those systems.
Such a compromise could result in unauthorized data access, system manipulation, or further malware distribution within affected environments.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability in KlinikaXP and KlinikaXP Insertino, you should ensure that you are running versions 5.39.01.01 or later for KlinikaXP and 3.1.0.1 or later for KlinikaXP Insertino, as these versions have removed the hard-coded credentials.
Additionally, previously exposed credentials have been rotated to prevent further unauthorized access.
Removing hard-coded credentials from the codebase and changing access credentials for internal services, especially the FTP server hosting update packages, are critical steps to prevent exploitation.