CVE-2026-108754 MEDIUM

CVE-2026-108754: GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger

Vendor Tbphp

Product gpt-load

Weakness CWE-532 · Sensitive info in logs

Published October 11, 2026

Last update October 18, 2026

View on NVD All CVEs

CVSS base score

4.8/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.

Key dates

02Disclosure timeline

October 11, 2026 CVE published

October 18, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-108754 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/532.html AskarLabs — CWE-532 write-up Insertion of Sensitive Information into Log File

Related vulnerabilities

04Related CVE

CVE-2023-52143 WordPress WP Stripe Checkout Plugin <= 1.2.2.37 is vulnerable to Sensitive Data Exposure CVE-2024-2302 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure CVE-2022-44587 WordPress WP 2FA plugin <= 2.6.3 - Sensitive Data Exposure via Log File vulnerability CVE-2024-32953 WordPress Newsletters plugin <= 4.9.5 - Sensitive Data Exposure vulnerability CVE-2024-31259 WordPress SearchIQ plugin <= 4.5 - Sensitive Data Exposure via Log File vulnerability