EagleCloud Aquila on-premises: insufficiently protected credentials
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.
Summary
EagleCloud Aquila on-premises versions through 2.6.7.2 store credentials insufficiently protected in the tunnel gateway and provisioning interfaces (CWE-522). An unauthenticated remote attacker can abuse authentication to escalate privileges and reach the access keys, secret keys and deployment secrets. The CNA scores this CVSS 4.0 8.7 (HIGH), with high confidentiality impact and no integrity or availability impact. CISA has not added it to KEV, and no exploit link is listed in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access the access keys, secret keys, and deployment secrets
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| EagleCloud | Aquila | up to 2.6.7.2 | — | No fix listed | CNA |
- Aquila VendorEagleCloud Affected up to 2.6.7.2 Fixed in — No fix listed CNA
Remediation
No fix is listed for EagleCloud Aquila on-premises versions through 2.6.7.2. Restrict network access to the tunnel gateway and provisioning interfaces, and rotate the access keys, secret keys and deployment secrets, since they may have been exposed. Check the vendor advisory for a fixed release.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-28 Threatist record created from CVE-2026-104384
- 2026-10-28 Alias added: GHSA-wm5p-g46q-pcjq
- 2026-10-28 Priority changed: MEDIUM → LOW
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: LOW → MEDIUM
References
More EagleCloud vulnerabilities
- TI-2026-81676 Code injection in EagleCloud Aquila on-premises Pigeon MFA service CVSS 4.0CRITICAL 9.4
Sources
- CVE-2026-104384 · CVE Program
- CVE-2026-104384 · NVD
- FIRST EPSS
- GHSA-wm5p-g46q-pcjq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences