Quick answers
- Is CVE-2026-78555 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78555 being exploited in the wild.
- How severe is CVE-2026-78555?
- Informational severity, with a CVSS score of 0, published 24 August 2026.
- Which products and versions are affected?
- RansomLook RansomLook.
- Is there a fix for CVE-2026-78555?
- A patch was published on 2026-08-24: Patch available in commit b358dfa Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78555 attacked?
- It is attacked with local access or over the network.
- Am I affected by CVE-2026-78555?
- Check whether you run RansomLook. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
RansomLook embedded complete API keys in hidden form fields on the /admin/apikeys authenticated page, even though the user interface displayed only truncated representations. The full tokens were exposed in the HTML source and could be recovered through client-side inspection, cached responses, debugging proxies, or monitoring systems. An attacker with a leaked API key could authenticate with the privileges assigned to that key, potentially gaining unauthorized access to private data. The fix replaces API keys with SHA-256-derived opaque handles in rendered pages, disclosing the full key only at creation time; administrative actions use the handles which are resolved server-side.
Affected products
- RansomLook RansomLook
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Patch available in commit b358dfa