CVE-2026-90510
Received Received - Intake

Hard-Coded Cryptographic Key in Dromara Orion-Visor

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90510
EUVD
EUVD-2026-76983

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dromara orion-visor to 2.5.7 (inc)
dromara orion-visor to 2.5.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.
CWE-320 Key Management Errors

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90510 is a vulnerability in the dromara orion-visor platform up to version 2.5.7. It involves a hard-coded cryptographic key in the HostKeyServiceImpl.encryptKey function. This key is used to encrypt sensitive credentials like SSH private keys and host passwords stored in the database. The hard-coded key is publicly accessible in configuration files, making encryption ineffective.

Detection Guidance

Check configuration files like application-prod.yaml and docker-compose.yaml for the hardcoded AES key 'uQeacXV8b3isvKLK' or 'I66AndrKWrwXjtBL'. Search for these strings in files using commands like 'grep -r "uQeacXV8b3isvKLK" /path/to/orion-visor' or 'grep -r "I66AndrKWrwXjtBL" /path/to/orion-visor'.

Impact Analysis

If an attacker gains access to encrypted data in the database through methods like SQL injection or unauthorized access, they can use the known hard-coded key to decrypt all SSH private keys and passwords. This allows direct SSH access to all managed hosts without authentication or audit logging, bypassing the bastion host's security controls.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and encryption standards such as GDPR and HIPAA. It results in unauthorized access to sensitive data (SSH keys, passwords), undermining confidentiality and integrity controls required by these regulations.

Mitigation Strategies

Remove the hardcoded AES key from configuration files and replace it with a unique, randomly generated key set via environment variables. Ensure the key is not stored in version control or exposed in logs. Update to the latest version if available or apply patches from the vendor.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90510. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart