TI-2026-09280 Aliases CVE-2026-10812 GHSA-xfqj-4cr9-9gr5

zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash

MEDIUM 44CWE-327Published 2026-06-04 · Updated 2026-06-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: None · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-327.

Summary

A vulnerability was detected in zilliztech GPTCache up to 0.1.44. Affected by this issue is the function BufferedReader.peek of the file gptcache/processor/pre.py of the component Cache Key Handler. Performing a manipulation of the argument input_data["image"] results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00075 0th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zilliztech	GPTCache	0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; 0.1.5; 0.1.6; 0.1.7; 0.1.8; 0.1.9; 0.1.10; 0.1.11; 0.1.12; 0.1.13; 0.1.14; 0.1.15; 0.1.16; 0.1.17; 0.1.18; 0.1.19; 0.1.20; 0.1.21; 0.1.22; 0.1.23; 0.1.24; 0.1.25; 0.1.26; 0.1.27; 0.1.28; 0.1.29; 0.1.30; 0.1.31; 0.1.32; 0.1.33; 0.1.34; 0.1.35; 0.1.36; 0.1.37; 0.1.38; 0.1.39; 0.1.40; 0.1.41; 0.1.42; 0.1.43; 0.1.44	—	No fix listed	CNA
—	gptcache (PyPI)	up to 0.1.44	—	No fix listed	GHSA-xfqj-4cr9-9gr5

GPTCache Vendorzilliztech Affected 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; 0.1.5; 0.1.6; 0.1.7; 0.1.8; 0.1.9; 0.1.10; 0.1.11; 0.1.12; 0.1.13; 0.1.14; 0.1.15; 0.1.16; 0.1.17; 0.1.18; 0.1.19; 0.1.20; 0.1.21; 0.1.22; 0.1.23; 0.1.24; 0.1.25; 0.1.26; 0.1.27; 0.1.28; 0.1.29; 0.1.30; 0.1.31; 0.1.32; 0.1.33; 0.1.34; 0.1.35; 0.1.36; 0.1.37; 0.1.38; 0.1.39; 0.1.40; 0.1.41; 0.1.42; 0.1.43; 0.1.44 Fixed in — No fix listed CNA
gptcache (PyPI) Vendor— Affected up to 0.1.44 Fixed in — No fix listed GHSA-xfqj-4cr9-9gr5

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zilliztech:gptcache::::::::	—	—	zilliztech

cpe:2.3:a:zilliztech:gptcache:*:*:*:*:*:*:*:* Versions — — ·zilliztech

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-10812
2026-10-03 Alias added: GHSA-xfqj-4cr9-9gr5

References

Other 2

TI-2026-09895 zilliztech deep-searcher collection_router.py CollectionRouter.invoke access control CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences