CVE-2026-75338

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-26 · updated 2026-09-09
Weakness: CWE-284

Description

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.

References

https://github.com/fangtang7/CVE/blob/main/disconf/Unauthenticated.md
https://github.com/fangtang7/CVE/blob/main/disconf/Unauthenticated.md

Get alerted when CVE-2026-75338 or the next vulnerability affects your stack