Is CVE-2026-100708 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100708 being exploited in the wild.

How severe is CVE-2026-100708?

High severity, with a CVSS score of 7.1, published 26 September 2026.

Is there a fix for CVE-2026-100708?

A patch was published on 2026-09-26: version 2.3.13 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100708 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100708?

Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100708: Froxlor information disclosure in Certificates API

CVE-2026-100708 · Severity: high · CVSS 7.1 · Published 2026-09-26

Froxlor, a web hosting control panel, returns TLS private keys in plaintext through its Certificates API. Low-privileged customer accounts can retrieve private keys for their own domains' certificates, while administrator accounts can extract keys belonging to other customers. Attackers possessing these keys can impersonate the affected domains, decrypt intercepted HTTPS traffic, and launch man-in-the-middle attacks.

Technologies: Froxlor. Vendors: Froxlor.

Quick answers

Is CVE-2026-100708 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100708 being exploited in the wild.
How severe is CVE-2026-100708?: High severity, with a CVSS score of 7.1, published 26 September 2026.
Which products and versions are affected?: Froxlor before 2.3.13.
Is there a fix for CVE-2026-100708?: A patch was published on 2026-09-26: version 2.3.13 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100708 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100708?: Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Certificates.get and Certificates.listing API commands execute SELECT queries on domain_ssl_settings and pass results directly to the JSON response handler without filtering sensitive columns. The ssl_key_file column, which contains raw PEM-formatted private key content, is returned unmodified. Authentication is required (customer API key or admin credentials) but there is no per-command role-based access control or column-level filtering, allowing authenticated users to enumerate private keys beyond their authorization level.

Affected products

Froxlor Froxlor before 2.3.13

Timeline

2026-09-26: disclosed
2026-09-26: patched: version 2.3.13 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.