# CVE-2026-67598: Emlog Pro disabled TLS certificate validation in AI service

Source: https://junglewise.ai/threats/cve-2026-67598-emlog-pro-disabled-tls-certificate-validation-in-ai-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67598 · Severity: high · CVSS 7.4 · Published 2026-08-03

Emlog Pro's AI service module unconditionally disables TLS certificate validation when communicating with external AI providers (like ChatGPT or image generation services). An attacker positioned on the network path can intercept these connections, steal the API key used to authenticate with the AI service, and inject fake AI responses that the application will execute—potentially leading to unauthorized database queries or configuration changes.

Technologies: [Emlog Pro](https://junglewise.ai/threats/technologies/emlog-pro). Vendors: [Emlog](https://junglewise.ai/threats/vendors/emlog).

## Quick answers

**Is CVE-2026-67598 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67598 being exploited in the wild.

**How severe is CVE-2026-67598?** High severity, with a CVSS score of 7.4, published 3 August 2026.

**Which products and versions are affected?** Emlog Pro through 2.6.23.

**Is there a fix for CVE-2026-67598?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67598 attacked?** It is attacked over the network or from the adjacent network, in a web application.

**Am I affected by CVE-2026-67598?** Check whether you run Emlog Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is improper certificate validation (CWE-295) in the AI service HTTP client. Four functions in include/service/ai.php (sendStream, sendImageRequest, send, and fetchSearchHtml) issue HTTPS requests to configured LLM providers with CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST unconditionally disabled; there is no configuration option to re-enable verification. An attacker with network adjacency (e.g., shared network segment, compromised router, or ARP spoofing) can perform a man-in-the-middle attack by presenting a self-signed certificate. Because SSL verification is disabled, the application accepts the attacker's certificate, allowing the attacker to read the Authorization Bearer token from outbound requests in plaintext and optionally inject crafted responses that trigger tool-call handlers (query_database, update_config). No patch is currently available.

## Affected products

- Emlog Emlog Pro through 2.6.23

## Timeline

- 2026-08-01: disclosed: GitHub security advisory GHSA-hf85-99vj-m4c5 published
- 2026-08-03: advisory: NVD entry CVE-2026-67598 published

## References

- [https://github.com/emlog/emlog/security/advisories/GHSA-hf85-99vj-m4c5](https://github.com/emlog/emlog/security/advisories/GHSA-hf85-99vj-m4c5)
- [https://www.vulncheck.com/advisories/emlog-pro-tls-certificate-validation-disabled-in-ai-php](https://www.vulncheck.com/advisories/emlog-pro-tls-certificate-validation-disabled-in-ai-php)

## Related threats

- [EMLOG-Pro cross-site scripting enabling shell upload](https://junglewise.ai/threats/cve-2026-88745-emlog-pro-2-6-29-contains-a-xss-vulnerability-that-enables)
- [Emlog Pro local file inclusion in article publishing interface](https://junglewise.ai/threats/cve-2026-46687-emlog-pro-local-file-inclusion-in-article-publishing-interface)
- [Emlog Pro path traversal in template upload feature](https://junglewise.ai/threats/cve-2026-39276-emlog-pro-path-traversal-in-template-upload-feature)
- [Emlog SQL injection in log_model.php](https://junglewise.ai/threats/cve-2026-42287-emlog-sql-injection-in-log-model-php)
- [Emlog CSRF in admin functions](https://junglewise.ai/threats/cve-2026-42286-emlog-csrf-in-admin-functions)