Executive brief
PentestGPT is an AI-powered penetration testing assistant. The application contains hardcoded API credentials in its telemetry logging component, which could allow attackers to access sensitive user data and telemetry information without proper authentication.
Technical details
The vulnerability exists in pentestgpt/core/langfuse.py due to hardcoded API credentials used for telemetry collection. An attacker with network access to the application can leverage these exposed credentials to bypass authentication and disclose sensitive user telemetry data. The vulnerability requires no special preconditions beyond network reachability to the affected component. This is a credential exposure vulnerability (CWE-798: Use of Hard-Coded Credentials) that enables unauthorized access to telemetry systems.
Affected products
- GreyDGL PentestGPT 1.0.0
Timeline
- 2026-08-27: disclosed