CVE-2026-78386
Unauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook API
Description
RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These records could contain internal fields such as header, which may include authentication headers, session cookies, or other credentials used to access monitored websites; init_script, which may contain logic used to bypass CAPTCHA, anti-bot protections, or paywalls; and browser, which discloses details about the scraping environment. An unauthenticated remote attacker could query the affected API endpoints and obtain these values. Leaked authentication material could potentially be replayed against the monitored service, while disclosure of scraping and bypass logic could allow site operators or other attackers to identify and defeat RansomLook's collection mechanisms. The patch introduces an explicit allowlist of fields permitted in public location records and strips all operator-side fields before returning data to unauthenticated users. The accompanying change from <string:postname> to <path:postname> appears to be a functional correction allowing legitimate post titles containing / and does not, based on this patch alone, represent the security issue.
INFO
Published Date :
Aug. 24, 2026, 2:17 p.m.
Last Modified :
Oct. 14, 2026, 1:10 p.m.
Remotely Exploit :
Yes !
Source :
5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | 5a6e4751-2f3f-4070-9419-94fb35b644e8 | ||||
| CVSS 4.0 | HIGH | 5a6e4751-2f3f-4070-9419-94fb35b644e8 |
Solution
- Implement an allowlist for public API fields.
- Remove operator-side fields from public responses.
- Apply the vendor patch.
- Review API data exposure.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-78386.
| URL | Resource |
|---|---|
| https://github.com/RansomLook/RansomLook/commit/cc9182930306ff36c7b3424817d49f18df3c85d1 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-78386 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-78386
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-78386 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-78386 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 14, 2026
Action Type Old Value New Value Added Translation Title: ransomlook, Description: RansomLook expuso la configuración de scraping sensible del lado del operador a través de múltiples respuestas de API no autenticadas. Los registros de ubicación asociados con grupos y mercados de ransomware fueron devueltos en gran parte textualmente a los llamadores no autenticados siempre que la ubicación misma no estuviera marcada como privada. Estos registros podrían contener campos internos como header, que pueden incluir encabezados de autenticación, cookies de sesión u otras credenciales utilizadas para acceder a sitios web monitoreados; init_script, que puede contener lógica utilizada para eludir CAPTCHA, protecciones anti-bot o muros de pago; y browser, que revela detalles sobre el entorno de scraping. Un atacante remoto no autenticado podría consultar los puntos finales de API afectados y obtener estos valores. El material de autenticación filtrado podría ser potencialmente reproducido contra el servicio monitoreado, mientras que la divulgación de la lógica de scraping y elusión podría permitir a los operadores del sitio u otros atacantes identificar y derrotar los mecanismos de recolección de RansomLook. El parche introduce una lista de permitidos explícita de campos permitidos en los registros de ubicación públicos y elimina todos los campos del lado del operador antes de devolver datos a usuarios no autenticados. El cambio que lo acompaña de <string:postname> a <path:postname> parece ser una corrección funcional que permite títulos de publicaciones legítimos que contienen / y no, basándose solo en este parche, representa el problema de seguridad. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 24, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-78386', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-24T15:10:10.690433Z'} -
New CVE Received by 5a6e4751-2f3f-4070-9419-94fb35b644e8
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/RansomLook/RansomLook/', 'vendor': 'ransomlook', 'product': 'ransomlook', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '2.0.0'}], 'defaultStatus': 'unaffected'}] Added Description RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These records could contain internal fields such as header, which may include authentication headers, session cookies, or other credentials used to access monitored websites; init_script, which may contain logic used to bypass CAPTCHA, anti-bot protections, or paywalls; and browser, which discloses details about the scraping environment. An unauthenticated remote attacker could query the affected API endpoints and obtain these values. Leaked authentication material could potentially be replayed against the monitored service, while disclosure of scraping and bypass logic could allow site operators or other attackers to identify and defeat RansomLook's collection mechanisms. The patch introduces an explicit allowlist of fields permitted in public location records and strips all operator-side fields before returning data to unauthenticated users. The accompanying change from <string:postname> to <path:postname> appears to be a functional correction allowing legitimate post titles containing / and does not, based on this patch alone, represent the security issue. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-200 Added Reference https://github.com/RansomLook/RansomLook/commit/cc9182930306ff36c7b3424817d49f18df3c85d1