CVE-2026-105030
Received Received - Intake

Information Disclosure in Kener Dashboard API

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: VulnCheck

Description
Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed monitor tag to endpoints such as monitor-bar and monitor-latency-chart to obtain names, descriptions, status, uptime history and latency.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-105030
EUVD
EUVD-2026-91857

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kener kener to 4.1.6 (exc)
rajnandan1 kener to 4.1.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-105030 is an information disclosure vulnerability in Kener 4.0.0 before 4.1.6. It allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API endpoints like monitor-bar and monitor-latency-chart using a monitor's tag. The issue occurs because these endpoints lack proper visibility filters, exposing sensitive details such as names, descriptions, status, uptime history, and latency metrics.

Detection Guidance

Check for unauthenticated access to Kener dashboard API endpoints like /dashboard-apis/monitor-bar and /dashboard-apis/monitor-latency-chart. Use curl commands to query these endpoints with known monitor tags and verify if hidden or inactive monitor data is returned. Example: curl http://<target>/dashboard-apis/monitor-bar?tag=<monitor_tag>

Impact Analysis

This vulnerability allows attackers to access sensitive monitoring data without authentication. If you use Kener for status pages, attackers could view hidden or inactive monitors, exposing internal system details, uptime history, and performance metrics. This could lead to reputational damage, operational insights for attackers, or further exploitation of exposed data.

Compliance Impact

This vulnerability may violate compliance requirements by exposing sensitive monitoring data without proper access controls. GDPR requires protection of personal data, and HIPAA mandates safeguards for health-related information. Unauthorized access to monitor details could lead to data breaches, triggering regulatory penalties or fines for non-compliance.

Mitigation Strategies

Upgrade Kener to version 4.1.6 or later to apply the necessary visibility filters. If upgrading is not immediately possible, restrict access to the vulnerable API endpoints at the network level or implement application-level access controls to enforce authentication for these endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105030. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart