Executive brief
Cerebrate, an open-source orchestration tool, contained a flaw where password hashes of new users were visible to administrators during the self-registration process. Authorized users with access to system logs or inbox messages could view these hashes, which could lead to account takeover if the hashes are cracked offline. This issue has been resolved in version 1.37 by ensuring sensitive credential data is hidden from view and logs.
Technical details
Cerebrate versions prior to 1.37 suffer from an information exposure vulnerability (CWE-200) within the self-registration workflow. The application stored registrant password hashes in the inbox message data payload, which was then returned unredacted in HTML, JSON, and CSV formats via inbox index and view responses. Additionally, these sensitive fields were written unredacted into system audit logs. An authenticated attacker with high privileges (PR:H) can access these interfaces or logs to extract hashes for pending registration requests. The vulnerability is mitigated in version 1.37 through the implementation of redaction logic for 'password' and 'authkey' fields in API outputs and recursive redaction in JSON audit log entries.
Affected products
- Cerebrate Project Cerebrate before 1.37
Timeline
- 2026-06-11: advisory: NVD publication date
- 2026-06-11: disclosed: CVE record published by CIRCL