CVE-2026-100708

Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domain_ssl_settings queries are passed through ApiCommand::response() without any field stripping or allowlist. A low-privileged authenticated customer API caller can retrieve the private keys of their own domains' certificates, including Let's Encrypt keys that Froxlor generates server-side and stores root-only (0600) and to which the customer otherwise has no filesystem access; reseller and customers_see_all admin accounts can dump the private keys of other principals through the same sink. Disclosed keys enable domain impersonation, passive decryption of captured TLS traffic, and active machine-in-the-middle attacks.

• CWE-200

• https://github.com/froxlor/froxlor/security/advisories/GHSA-6q2v-jjq5-m2c8
• https://www.vulncheck.com/advisories/froxlor-before-2.3.13-private-key-disclosure-via-certificates-api

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100702Nodemailer before 10.0.2 fails to properly flatten deeply ne…5.9
• CVE-2026-100703Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Li…7.7
• CVE-2026-100704Kyverno is a policy engine for Kubernetes. In versions 1.14.…7.7
• CVE-2026-100705Kyverno before 1.19.1 is vulnerable to server-side request f…7.6
• CVE-2026-100706kyverno before 1.19.1 fails to properly validate URL-encoded…9.9
• CVE-2026-100707Kyverno before 1.19.1 contains a namespace isolation bypass …7.7
• CVE-2026-100709Froxlor through 2.3.10 stores only a numeric user ID in reme…7.5
• CVE-2026-10071DreamMaker developed by Interinfo has an Arbitrary File Uplo…9.8
• CVE-2026-100710Froxlor through 2.3.10 does not filter sensitive columns fro…4.9
• CVE-2026-100711froxlor versions before 2.3.12 fail to invalidate existing p…7.5
• CVE-2026-100712froxlor through 2.3.10 disables a user's two-factor authenti…6.5
• CVE-2026-100713Froxlor 2.3.10 and earlier contain a time-of-check time-of-u…7.8