CVE-2026-108754

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108754
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108754.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108754
Published
2026-10-11T12:19:53Z
Modified
2026-10-13T02:45:36Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger
Details

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-532"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108754.json"
}
References

Affected packages

Git / github.com/tbphp/gpt-load

Affected ranges

Type
GIT
Repo
https://github.com/tbphp/gpt-load
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a12882be9e06011da5e0284db5dd4617a7ca6e6d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.4.11"
        },
        {
            "fixed":  "1.4.11"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v1.*
v1.0.0-beta
v1.0.1-beta
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.0.2-beta
v1.0.20
v1.0.21
v1.0.22
v1.0.3-beta
v1.0.4-beta
v1.0.5-beta
v1.0.6-beta
v1.0.7-beta
v1.0.8-beta
v1.0.9-beta
v1.1.0
v1.2.0
v1.2.1
v1.3.0
v1.3.0-beta.1
v1.3.0-beta.2
v1.3.0-beta.3
v1.3.0-beta.4
v1.3.0-beta.5
v1.3.0-beta.6
v1.3.1
v1.3.2
v1.4.0
v1.4.0-beta.1
v1.4.0-beta.2
v1.4.1
v1.4.10
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108754.json"