Is CVE-2026-58026 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58026 being exploited in the wild.

How severe is CVE-2026-58026?

Informational severity, with a CVSS score of 0, published 1 July 2026.

Which products and versions are affected?

Wikimedia Foundation MediaWiki Before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Is there a fix for CVE-2026-58026?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-58026 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-58026?

Check whether you run Wikimedia Foundation MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58026: Wikimedia Foundation MediaWiki information disclosure in Parser.php

CVE-2026-58026 · Severity: info · CVSS 0 · Published 2026-07-01

MediaWiki, the software powering Wikipedia and many other wikis, has a vulnerability that could allow unauthorized individuals to view sensitive information. This issue occurs within the system's content parsing component, which handles how wiki text is processed and displayed. While the specific impact is rated as low, it could potentially lead to the disclosure of data that should remain private. Organizations using MediaWiki should update to the latest patched versions to ensure their data remains protected.

Technologies: Wikimedia Foundation MediaWiki. Vendors: Wikimedia Foundation.

Quick answers

Is CVE-2026-58026 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58026 being exploited in the wild.
How severe is CVE-2026-58026?: Informational severity, with a CVSS score of 0, published 1 July 2026.
Which products and versions are affected?: Wikimedia Foundation MediaWiki Before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Is there a fix for CVE-2026-58026?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58026 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-58026?: Check whether you run Wikimedia Foundation MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability exists in Wikimedia Foundation MediaWiki within the 'includes/Parser/Parser.php' component. The flaw is triggered during the parsing of wiki content and requires a network-based attacker with low privileges and some level of user interaction to exploit. While the vendor-provided CVSS score is 0.0, the vulnerability is officially tracked as an information disclosure issue. The vulnerability is addressed in MediaWiki versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9.

Affected products

Wikimedia Foundation MediaWiki Before 1.46.0, 1.45.4, 1.44.6, 1.43.9

Timeline

2026-07-01: advisory: NVD publication date

References

https://phabricator.wikimedia.org/T299359

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.