CVE-2026-44478

hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the unauthenticated POST /v1/onboarding/config endpoint by checking onboardingCompleted and canReRunOnboarding before allowing config overwrites. However, GET /v1/onboarding/config still leaks all infrastructure secrets in plaintext to unauthenticated users when the ONBOARDING_RECOVERY_TOKEN stored in the database is an empty string. This vulnerability is fixed in 2026.4.0.

• CWE-284
• CWE-287

• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7c8p-hj4p-3q3f
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7c8p-hj4p-3q3f

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44470The Claude Desktop app gives you Claude Code with a graphica…7.8
• CVE-2026-44471gitoxide is an implementation of git written in Rust. Prior …7.8
• CVE-2026-44473Ella Core is a 5G core designed for private networks. Prior …7.1
• CVE-2026-44474Ella Core is a 5G core designed for private networks. Prior …3.7
• CVE-2026-44475Ella Core is a 5G core designed for private networks. Prior …6.1
• CVE-2026-44477CloudNativePG is a platform designed to manage PostgreSQL da…9.9
• CVE-2026-44479Vercel’s AI Cloud is a unified platform for building modern …5.5
• CVE-2026-4448Heap buffer overflow in ANGLE in Google Chrome prior to 146.…8.8
• CVE-2026-44482soundcloud-rpc is a SoundCloud Client with Discord Rich Pres…9.6
• CVE-2026-44483RVF (formerly Remix Validated Form) provides easy form valid…8.2
• CVE-2026-44484PyTorch Lightning is a deep learning framework to pretrain a…9.8
• CVE-2026-44486Axios is a promise based HTTP client for the browser and Nod…7.5