CVE-2026-108754CWE-532

CVE-2026-108754

Low · published October 11, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
1.2
In the wild
Unconfirmed
What it is

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
4.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00110 · 1.2th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-10-11T17:17Z
References (5)
https://github.com/tbphp/gpt-load · [email protected]https://github.com/tbphp/gpt-load/blob/a12882be9e06011da5e0284db5dd4617a7ca6e6d/internal/middleware/middleware.go#L20-L74 · [email protected]https://github.com/tbphp/gpt-load/blob/a12882be9e06011da5e0284db5dd4617a7ca6e6d/internal/middleware/middleware.go#L247-L254 · [email protected]https://hackmd.io/@haind03/tbphp-gpt-load-proxy-key-access-log-disclosure · [email protected]https://www.vulncheck.com/advisories/gpt-load-through-1.4.11-cleartext-proxy-key-logging-via-access-logger · [email protected]
EPSS history
Timeline
  • 13 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 11 OCT 12:19Z
    GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger
    cvelistv5
  • 11 OCT 12:19Z
    GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger
    cvelistv5