CVE-2026-110667
7.3HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-259, CWE-798
Impact
Remote unauthenticated attackers can exploit hard-coded credentials to compromise confidentiality, integrity, and availability. They only need network access to the running sar2html instance.
Root cause
The SECRET_KEY parameter is hard-coded directly in sar2html.py.
Affected systems
cemtan sar2html 4.0.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official fixed version is available yet as the maintainer has not responded. Restrict network access to the application or replace the hard-coded SECRET_KEY value directly in sar2html.py with a strong, generated secret.
$ grep -n "SECRET_KEY" sar2html.pyAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.