Executive brief
orion-visor is a bastion host and server management platform that stores sensitive SSH private keys and host passwords in an encrypted database. The application uses a hardcoded AES encryption key that is identical across all deployments and publicly visible in the open-source repository. An attacker who gains access to the encrypted database (via SQL injection, database breach, or backup exposure) can decrypt all credentials and gain unrestricted SSH access to every managed server, completely bypassing the security controls of the bastion host.
Technical details
The vulnerability is a use of hardcoded cryptographic key (CWE-321) in the HostKeyServiceImpl.encryptKey() method. The AES secret key "uQeacXV8b3isvKLK" is hardcoded as a default value in application-prod.yaml and docker-compose.yaml configuration files. If the SECRET_KEY environment variable is not explicitly set during deployment, the fallback hardcoded value is used for all AES encryption and decryption operations via AesEncryptUtils. The vulnerability affects encryption of SSH public keys, private keys, and key passphrases stored in the host_key database table. An attacker with access to encrypted ciphertext from the database can trivially decrypt all stored credentials using the publicly known key, requiring only network access to the database or possession of database backups. The vulnerability affects orion-visor up to version 2.5.7, and the maintainers have not yet responded to early disclosure.
Affected products
- dromara orion-visor up to 2.5.7
Timeline
- 2026-07-31: disclosed: Security issue reported on GitHub
- 2026-09-13: advisory: CVE-2026-90510 published