by Kastro
Paper/Archive/CVE-2026-67598

CVE-2026-67598

emlog emlog — Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

EPSS 0.3%public exploitCVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 17.6.176 × 203.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query_database and update_config tool handlers.

Affected

ProductAffectedFixed inSource
emlog≤ 2.6.23–CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/emlog/emlog/security/advisories/GHSA-hf85-99vj-m4c5writeupvulncheck.com/advisories/emlog-pro-tls-certificate-validation-disabled-in-ai-php