What’s Vulnerable › Vulnerabilities

CVE-2026-67598: Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-03 · updated 2026-09-09
• Weakness: CWE-295

Description

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query_database and update_config tool handlers.

Affected products

• emlog: through 2.6.23

References

• https://github.com/emlog/emlog/security/advisories/GHSA-hf85-99vj-m4c5
• https://www.vulncheck.com/advisories/emlog-pro-tls-certificate-validation-disabled-in-ai-php
• https://github.com/emlog/emlog/security/advisories/GHSA-hf85-99vj-m4c5

Get alerted when CVE-2026-67598 or the next vulnerability affects your stack