Read the docs
TI-2026-67392 Aliases CVE-2026-105030GHSA-9wr3-32qm-xqr7

Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed monitor tag to endpoints such as monitor-bar and monitor-latency-chart to obtain names, descriptions, status, uptime history and latency.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00331 26th percentileScored 2026-11-07
Fix Fixed kener (rajnandan1): 4.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rajnandan1kener4.0.0 to before 4.1.64.1.6Patch availableCNA
  • kener Vendorrajnandan1 Affected 4.0.0 to before 4.1.6 Fixed in 4.1.6 Patch available CNA

Remediation

  • Fix · CNA kener (rajnandan1) Fixed in 4.1.6

Timeline

  1. 2026-10-03 Threatist record created from CVE-2026-105030
  2. 2026-10-03 Alias added: GHSA-9wr3-32qm-xqr7
  3. 2026-10-04 Priority changed: MEDIUM → LOW
  4. 2026-10-05 CISA SSVC decision points changed

References

Patch 1

Other 2

  • TI-2026-80956 Authentication bypass in Kener via hardcoded fallback JWT secret CVSS 4.0CRITICAL 9.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences