# CVE-2026-61458: pglombardo PasswordPusher brute force vulnerability in passphrase access

Source: https://junglewise.ai/threats/cve-2026-61458-pglombardo-passwordpusher-brute-force-vulnerability-in-passphrase  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-61458 · Severity: high · CVSS 7.5 · Published 2026-07-13

PasswordPusher, a tool used to securely share sensitive information like passwords, contains a flaw that allows attackers to guess passphrases through brute-force attacks. Because the system does not limit the number of failed attempts for specific shared links, an attacker who has the link can systematically test thousands of common passwords. If successful, the attacker can gain full access to the secret data intended for another recipient.

## Quick answers

**Is CVE-2026-61458 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61458 being exploited in the wild.

**How severe is CVE-2026-61458?** High severity, with a CVSS score of 7.5, published 13 July 2026.

**Which products and versions are affected?** pglombardo PasswordPusher < 2.9.2.

**Is there a fix for CVE-2026-61458?** A patch was published on 2026-07-13: Vendor released version 2.9.2 to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61458 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-61458?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A brute-force vulnerability exists in PasswordPusher's passphrase verification logic within the 'POST /p/:token/access' endpoint. The application lacks route-specific rate limiting and does not implement a per-push failed attempt counter or lockout mechanism. While a global IP-based throttle of 120 requests per minute exists via Rack::Attack, it is insufficient to prevent the recovery of short or dictionary-based passphrases. An attacker with a valid push token can automate passphrase guesses to bypass protection and access the secret payload. The issue is addressed in version 2.9.2 by implementing specific throttling and lockout logic.

## Affected products

- pglombardo PasswordPusher < 2.9.2

## Timeline

- 2026-07-06: advisory: GitHub Security Advisory published by vendor
- 2026-07-13: disclosed: CVE published and NVD record created
- 2026-07-13: patched: Vendor released version 2.9.2 to address the issue

## References

- [https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-59w3-h5v2-c4xw](https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-59w3-h5v2-c4xw)
- [https://www.vulncheck.com/advisories/passwordpusher-passphrase-brute-force-via-unthrottled-endpoint](https://www.vulncheck.com/advisories/passwordpusher-passphrase-brute-force-via-unthrottled-endpoint)