CVE-2026-108754: GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the exposed proxy keys?
An attacker needs read access to the GPT-Load console logs or the ./data/logs/app.log file. They can recover keys from logged Gemini-style requests and use them against the corresponding group.
Are credentials exposed through normal request logging?
Yes. The Gin Logger middleware records the raw query string before extractAuthKey removes the key parameter, so client proxy keys can be written to access logs in cleartext.
How can I determine whether keys may already have been exposed?
Review console output and ./data/logs/app.log for Gemini-style requests whose raw query strings contain a key parameter. Any proxy key present in those logs should be treated as disclosed for its corresponding group.