Quick answers
- Is CVE-2026-78386 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78386 being exploited in the wild.
- How severe is CVE-2026-78386?
- Informational severity, published 24 August 2026.
- Which products and versions are affected?
- RansomLook RansomLook.
- Is there a fix for CVE-2026-78386?
- A patch was published on 2026-08-24: Patch applied via commit cc91829 introducing allowlist filtering Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78386 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-78386?
- Check whether you run RansomLook. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an information disclosure flaw in RansomLook's API endpoint handling for location records. The root cause is insufficient access control and output filtering: the API returned operator-side internal fields (header, init_script, browser) to unauthenticated callers whenever a location record was not explicitly marked private. An unauthenticated remote attacker could directly query the affected API endpoints and extract these sensitive fields verbatim, which may contain authentication headers, session cookies, and anti-bot bypass logic. The patch introduces an explicit allowlist of permitted fields for public location records and strips all operator-side fields before returning data to unauthenticated users. This fix prevents further disclosure of scraping credentials and anti-detection techniques.
Affected products
- RansomLook RansomLook
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Patch applied via commit cc91829 introducing allowlist filtering