CVE-2026-105030: Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API
Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed monitor tag to endpoints such as monitor-bar and monitor-latency-chart to obtain names, descriptions, status, uptime history and latency.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Kener versions 4.0.0 through versions before 4.1.6 are affected. The affected dashboard API handlers can be queried without authentication.
What does an attacker need to exploit this issue?
An attacker needs a known or guessed monitor tag and network access to the vulnerable dashboard API. No credentials or user interaction are required.
What information can be disclosed?
The exposed data can include hidden or inactive monitor names, descriptions, current status, uptime history, and latency information.
How can I determine whether hidden monitors are exposed?
Test the monitor-bar and monitor-latency-chart dashboard API handlers using tags for hidden or inactive monitors, without authenticating. If the handlers return monitor details, the instance is affected.