# CVE-2026-53912: Cerebrate sensitive information exposure in self-registration inbox

Source: https://junglewise.ai/threats/cve-2026-53912-cerebrate-sensitive-information-exposure-in-self-registration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-53912 · Severity: info · CVSS 5.1 · Published 2026-06-11

Cerebrate, an open-source orchestration tool, contained a flaw where password hashes of new users were visible to administrators during the self-registration process. Authorized users with access to system logs or inbox messages could view these hashes, which could lead to account takeover if the hashes are cracked offline. This issue has been resolved in version 1.37 by ensuring sensitive credential data is hidden from view and logs.

Technologies: [Cerebrate Project Cerebrate](https://junglewise.ai/threats/technologies/cerebrate). Vendors: [Cerebrate Project](https://junglewise.ai/threats/vendors/cerebrate-project).

## Quick answers

**Is CVE-2026-53912 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53912 being exploited in the wild.

**How severe is CVE-2026-53912?** Informational severity, with a CVSS score of 5.1, published 11 June 2026.

**Which products and versions are affected?** Cerebrate Project Cerebrate before 1.37.

**Is there a fix for CVE-2026-53912?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53912 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53912?** Check whether you run Cerebrate Project Cerebrate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Cerebrate versions prior to 1.37 suffer from an information exposure vulnerability (CWE-200) within the self-registration workflow. The application stored registrant password hashes in the inbox message data payload, which was then returned unredacted in HTML, JSON, and CSV formats via inbox index and view responses. Additionally, these sensitive fields were written unredacted into system audit logs. An authenticated attacker with high privileges (PR:H) can access these interfaces or logs to extract hashes for pending registration requests. The vulnerability is mitigated in version 1.37 through the implementation of redaction logic for 'password' and 'authkey' fields in API outputs and recursive redaction in JSON audit log entries.

## Affected products

- Cerebrate Project Cerebrate before 1.37

## Timeline

- 2026-06-11: advisory: NVD publication date
- 2026-06-11: disclosed: CVE record published by CIRCL

## References

- [https://github.com/cerebrate-project/cerebrate/commit/02da6d708d610c8509a1aab3f58f53f0a91d8a04.](https://github.com/cerebrate-project/cerebrate/commit/02da6d708d610c8509a1aab3f58f53f0a91d8a04.)

## Related threats

- [Cerebrate authorization bypass via ID mass-assignment in CRUD edit](https://junglewise.ai/threats/cve-2026-53911-cerebrate-authorization-bypass-via-id-mass-assignment-in-crud)
- [Cerebrate mass-assignment vulnerability in CRUD add path](https://junglewise.ai/threats/cve-2026-53901-cerebrate-mass-assignment-vulnerability-in-crud-add-path)