Is CVE-2026-53912 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53912 being exploited in the wild.

How severe is CVE-2026-53912?

Informational severity, with a CVSS score of 5.1, published 11 June 2026.

Which products and versions are affected?

Cerebrate Project Cerebrate before 1.37.

Is there a fix for CVE-2026-53912?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-53912 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-53912?

Check whether you run Cerebrate Project Cerebrate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53912: Cerebrate sensitive information exposure in self-registration inbox

CVE-2026-53912 · Severity: info · CVSS 5.1 · Published 2026-06-11

Cerebrate, an open-source orchestration tool, contained a flaw where password hashes of new users were visible to administrators during the self-registration process. Authorized users with access to system logs or inbox messages could view these hashes, which could lead to account takeover if the hashes are cracked offline. This issue has been resolved in version 1.37 by ensuring sensitive credential data is hidden from view and logs.

Technologies: Cerebrate Project Cerebrate. Vendors: Cerebrate Project.

Quick answers

Is CVE-2026-53912 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53912 being exploited in the wild.
How severe is CVE-2026-53912?: Informational severity, with a CVSS score of 5.1, published 11 June 2026.
Which products and versions are affected?: Cerebrate Project Cerebrate before 1.37.
Is there a fix for CVE-2026-53912?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-53912 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-53912?: Check whether you run Cerebrate Project Cerebrate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Cerebrate versions prior to 1.37 suffer from an information exposure vulnerability (CWE-200) within the self-registration workflow. The application stored registrant password hashes in the inbox message data payload, which was then returned unredacted in HTML, JSON, and CSV formats via inbox index and view responses. Additionally, these sensitive fields were written unredacted into system audit logs. An authenticated attacker with high privileges (PR:H) can access these interfaces or logs to extract hashes for pending registration requests. The vulnerability is mitigated in version 1.37 through the implementation of redaction logic for 'password' and 'authkey' fields in API outputs and recursive redaction in JSON audit log entries.

Affected products

Cerebrate Project Cerebrate before 1.37

Timeline

2026-06-11: advisory: NVD publication date
2026-06-11: disclosed: CVE record published by CIRCL

References

https://github.com/cerebrate-project/cerebrate/commit/02da6d708d610c8509a1aab3f58f53f0a91d8a04.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.