CVE-2026-100708: Froxlor before 2.3.13 Private Key Disclosure via Certificates API
Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through ApiCommand::response() without any field stripping or allowlist. A low-privileged authenticated customer API caller can retrieve the private keys of their own domains' certificates, including Let's Encrypt keys that Froxlor generates server-side and stores root-only (0600) and to which the customer otherwise has no filesystem access; reseller and customersseeall admin accounts can dump the private keys of other principals through the same sink. Disclosed keys enable domain impersonation, passive decryption of captured TLS traffic, and active machine-in-the-middle attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.13
Event History
Frequently Asked Questions
Which authenticated users can retrieve private keys through the affected API?
A low-privileged customer API caller can retrieve the private keys for certificates belonging to their own domains. Resellers and customers_see_all administrator accounts can retrieve private keys belonging to other principals.
Does protecting the key files on disk prevent this disclosure?
No. The issue exposes the raw PEM content through JSON API responses, including Let's Encrypt keys that are stored root-only with 0600 permissions and would otherwise be inaccessible to the customer through the filesystem.
What access does an attacker need to exploit this?
The attacker needs an authenticated API account with at least customer-level privileges and must be able to invoke the Certificates.get or Certificates.listing API commands. No user interaction is required.
How can an administrator check for exposure?
Review responses from Certificates.get and Certificates.listing for an ssl_key_file field containing PEM private-key material. Accounts with reseller or customers_see_all access require particular review because they can access keys for other principals.
Which deployments are affected?
Froxlor versions before 2.3.13 are affected. The disclosed material includes private keys generated and stored by Froxlor for domain certificates.