CVE-2026-67598
Received Received - Intake

TLS Certificate Validation Bypass in Emlog Pro

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query_database and update_config tool handlers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-67598
EUVD
EUVD-2026-52405

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
emlog pro to 2.6.23 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Emlog Pro through version 2.6.23 has a vulnerability where TLS certificate validation is disabled in the AI service component. This allows attackers on the same network to intercept HTTPS requests to configured LLM providers by presenting fake TLS certificates. The issue occurs because functions like sendStream(), sendImageRequest(), send(), and fetchSearchHtml() unconditionally disable CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST, preventing proper certificate verification.

Detection Guidance

The vulnerability involves disabled TLS certificate validation in Emlog Pro 2.6.23. To detect it, inspect the code for disabled CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST settings in functions like sendStream(), sendImageRequest(), send(), and fetchSearchHtml(). Check network traffic for HTTPS requests to LLM providers that bypass certificate validation.

Impact Analysis

This vulnerability allows attackers to perform man-in-the-middle attacks to steal Authorization Bearer API keys used for LLM provider access. They can also inject malicious AI responses that may be executed by the tool-call pipeline, potentially leading to unauthorized database queries or configuration changes. The impact includes data breaches, unauthorized system modifications, and compromised AI interactions.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and secure communication. GDPR requires appropriate technical measures to protect personal data, which this vulnerability undermines by enabling unauthorized interception. HIPAA mandates secure transmission of protected health information, which is compromised by the lack of TLS verification. Organizations using this software may face regulatory penalties and increased liability.

Mitigation Strategies

Immediately upgrade Emlog Pro to a version where TLS certificate validation is enabled by default. If no update is available, manually enable CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST in the affected functions. Rotate any exposed Authorization Bearer API keys for LLM providers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67598. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart