Is CVE-2026-100710 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100710 being exploited in the wild.

How severe is CVE-2026-100710?

Medium severity, with a CVSS score of 4.9, published 26 September 2026.

Is there a fix for CVE-2026-100710?

A patch was published on 2026-09-06: Fix released in version 2.3.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100710 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100710?

Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100710: Froxlor information disclosure of DKIM private key via API

CVE-2026-100710 · Severity: medium · CVSS 4.9 · Published 2026-09-26

Froxlor is a web hosting control panel that manages domains and email configuration. An authenticated admin with delegated cross-tenant visibility can extract DKIM private signing keys—cryptographic secrets used to verify domain ownership—for domains belonging to other administrators. An attacker with these keys can forge emails that appear to come from legitimate domains, bypassing email authentication checks that recipients rely on.

Technologies: Froxlor. Vendors: Froxlor.

Quick answers

Is CVE-2026-100710 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100710 being exploited in the wild.
How severe is CVE-2026-100710?: Medium severity, with a CVSS score of 4.9, published 26 September 2026.
Which products and versions are affected?: Froxlor through 2.3.10.
Is there a fix for CVE-2026-100710?: A patch was published on 2026-09-06: Fix released in version 2.3.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100710 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100710?: Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Domains::get(), Domains::listing(), SubDomains::get(), and admin-branch SubDomains::listing() API commands perform an unfiltered wildcard SELECT on the panel_domains table and return all columns including dkim_privkey without sanitization. An authenticated non-superadmin with the customers_see_all delegation flag can call these endpoints to read other tenants' DKIM private keys. The vulnerability is an information disclosure (CWE-200) requiring prior admin authentication; a single listing call can exfiltrate keys for all visible domains.

Affected products

Froxlor Froxlor through 2.3.10

Timeline

2026-09-26: disclosed
2026-09-06: patched: Fix released in version 2.3.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.