Quick answers
- Is CVE-2026-78553 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78553 being exploited in the wild.
- How severe is CVE-2026-78553?
- Informational severity, published 24 August 2026.
- Which products and versions are affected?
- RansomLook RansomLook.
- Is there a fix for CVE-2026-78553?
- A patch was published on 2026-08-24: Patch released in commit df9d47e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78553 attacked?
- It is attacked with local access, in a web application.
- Am I affected by CVE-2026-78553?
- Check whether you run RansomLook. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an insecure file permissions vulnerability affecting the Flask session-signing key file. The secret_key file is created with default process umask (typically resulting in 0644 permissions) rather than restrictive permissions (0600), making it readable by any local user. The exposed key is cryptographic material used to sign Flask session cookies and derive legacy API keys. An attacker with local file-system access can read the key and generate valid session cookies to impersonate any user, including administrators. In LDAP authentication configurations, exploitation is particularly easy because the session loader accepts usernames that do not correspond to local users. A patch has been released that creates new key files atomically with 0600 permissions and restricts permissions on existing files during startup.
Affected products
- RansomLook RansomLook
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Patch released in commit df9d47e