CVE-2026-0239: Palo Alto Networks Chronosphere Chronocollector information disclosure

CVE-2026-0239 · Severity: medium · CVSS 6.5 · Published 2026-05-13

Palo Alto Networks Chronosphere Chronocollector, a tool used for gathering system metrics and monitoring data, contains a security flaw that could expose sensitive information. An attacker with access to the local network could exploit this vulnerability to retrieve internal data without needing a username or password. This could lead to the exposure of system configurations or other sensitive operational details, though it does not allow the attacker to modify data or shut down the service.

Vendors: Palo Alto Networks, Paloaltonetworks.

Quick answers

Is CVE-2026-0239 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-0239 being exploited in the wild.
How severe is CVE-2026-0239?
Medium severity, with a CVSS score of 6.5, published 13 May 2026.
Which products and versions are affected?
Palo Alto Networks Chronocollector < v0.116.0.
Is there a fix for CVE-2026-0239?
A patch was published on 2026-05-13: Fix released in version v0.116.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0239 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-0239?
Check whether you run Palo Alto Networks Chronocollector or Paloaltonetworks Chronosphere Collector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in Palo Alto Networks Chronosphere Chronocollector versions prior to v0.116.0. The flaw is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), where the collector service fails to properly restrict access to sensitive system data. An unauthenticated attacker located on the same adjacent network can access the service to retrieve sensitive information. The vulnerability does not require user interaction or elevated privileges. The issue is resolved in version v0.116.0 and later.

Affected products

  • Palo Alto Networks Chronosphere Chronocollector < v0.116.0

Timeline

  • 2026-05-13: disclosed: Initial internal discovery and publication by Palo Alto Networks
  • 2026-05-13: patched: Fix released in version v0.116.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.