CVE-2026-100708
Deferred Deferred - Pending Action

Froxlor Private Key Exposure via API Response

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domain_ssl_settings queries are passed through ApiCommand::response() without any field stripping or allowlist. A low-privileged authenticated customer API caller can retrieve the private keys of their own domains' certificates, including Let's Encrypt keys that Froxlor generates server-side and stores root-only (0600) and to which the customer otherwise has no filesystem access; reseller and customers_see_all admin accounts can dump the private keys of other principals through the same sink. Disclosed keys enable domain impersonation, passive decryption of captured TLS traffic, and active machine-in-the-middle attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100708
EUVD
EUVD-2026-87681

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor to 2.3.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100708 is a vulnerability in Froxlor versions before 2.3.13 where the Certificates.get and Certificates.listing API endpoints return raw TLS private key content stored in the ssl_key_file column without filtering. This exposes sensitive private keys to authenticated users, including low-privileged customers and administrators.

Detection Guidance

Check Froxlor API responses for the Certificates.get and Certificates.listing endpoints. If raw PEM private key content appears in JSON responses, the system is vulnerable. Use curl to query these endpoints with valid credentials and inspect the output for ssl_key_file content.

Impact Analysis

Exposed private keys enable attackers to impersonate domains, decrypt captured TLS traffic passively, or perform active man-in-the-middle attacks. Low-privileged users can access their own keys, while admins can retrieve keys for other domains, escalating the risk of unauthorized access and data breaches.

Mitigation Strategies

Upgrade Froxlor to version 2.3.13 or later immediately. If upgrading is not possible, remove the ssl_key_file field from API responses in the Certificates.get and Certificates.listing methods. Implement allowlist-based response serialization to prevent sensitive data exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100708. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart