CVE-2026-37012

UNKNOWN NVD

CVSS Score 0

Severity UNKNOWN

Published Aug 27, 2026

Vendor unknown

Description

A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.

References

https://github.com/GreyDGL/PentestGPT/blob/6e84be8df5338b724adfb21c19700dd03547b007/pentestgpt/core/langfuse.py#L114
https://yerangamage.com/cves/detail/?slug=pentestgpt-hardcoded-credentials