What’s Vulnerable › Vulnerabilities

CVE-2026-108754: GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-11 · updated 2026-10-18
• Weakness: CWE-532

Description

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.

Affected products

• tbphp gpt-load: through 1.4.11

References

• https://github.com/tbphp/gpt-load
• https://github.com/tbphp/gpt-load/blob/a12882be9e06011da5e0284db5dd4617a7ca6e6d/internal/middleware/middleware.go#L20-L74
• https://github.com/tbphp/gpt-load/blob/a12882be9e06011da5e0284db5dd4617a7ca6e6d/internal/middleware/middleware.go#L247-L254
• https://hackmd.io/@haind03/tbphp-gpt-load-proxy-key-access-log-disclosure
• https://www.vulncheck.com/advisories/gpt-load-through-1.4.11-cleartext-proxy-key-logging-via-access-logger

Get alerted when CVE-2026-108754 or the next vulnerability affects your stack