CVE-2026-37012

Deferred Deferred - Pending Action

Hard-Coded Credentials in PentestGPT 1.0.0

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: MITRE

Description

A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-37012

Affected Vendors & Products

Vendor	Product	Version / Range
greydgl	pentestgpt	1.0.0
pentestgpt	pentestgpt	1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability in PentestGPT 1.0.0 allows remote attackers to access sensitive user telemetry data due to hardcoded API credentials in the file pentestgpt/core/langfuse.py. The integration uses Langfuse for tracking tool executions and messages, but the hardcoded credentials expose this data to unauthorized parties.

Detection Guidance

Check for hardcoded API credentials in PentestGPT configuration files, particularly in pentestgpt/core/langfuse.py. Inspect environment variables for LANGFUSE_ENABLED or --no-telemetry flags. Review network traffic for unauthorized connections to Langfuse services.

Impact Analysis

If exploited, attackers could access your telemetry data, including tool executions, agent messages, and flag detections. This may reveal sensitive information about your penetration testing activities, tools used, and detected vulnerabilities.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if exposed telemetry data includes personally identifiable information (PII) or protected health information (PHI). Organizations may face legal penalties for failing to protect such data.

Mitigation Strategies

Remove or replace hardcoded API credentials in PentestGPT. Disable telemetry by setting LANGFUSE_ENABLED=false or using the --no-telemetry flag. Update to a patched version if available. Monitor network traffic for suspicious connections to Langfuse endpoints.

Hi! I’m here to help you understand CVE-2026-37012. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70