Cleartext proxy key logging in GPT-Load via access logger
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-532.
Summary
GPT-Load through 1.4.11 writes client proxy keys in cleartext to its logs because the Gin Logger middleware records the raw query string before the key parameter is stripped. An attacker with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group. The CVSS 4.0 vector rates this as a local attack requiring low privileges. The weakness is CWE-532.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for GPT-Load.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108754
- 2026-10-11 Alias added: GHSA-cg67-pj93-c6m6
- 2026-10-18 CISA SSVC decision points changed
References
Sources
- CVE-2026-108754 · CVE Program
- CVE-2026-108754 · NVD
- FIRST EPSS
- GHSA-cg67-pj93-c6m6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences