CVE-2026-11347: Hardcoded Cryptographic Keys and Weak IV Generation in linqi
The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can leverage these vulnerabilities to decrypt sensitive obfuscated strings, including ConnectionString values containing database credentials from appsettings.json.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove any hardcoded cryptographic keys from the application/source/config. Store keys in a dedicated secret store or key management system (do not embed keys in source or appsettings.json).
linqi hardcoded_cryptographic_keys = remove - Configuration
Replace the weak, limited-ASCII dynamic IV generation with a cryptographically secure random IV generator. Ensure IVs are full-entropy and of the correct block size (e.g., 16 bytes for AES).
linqi IV_generation = use cryptographically secure random full-entropy IVs - Configuration
Stop relying on unauthenticated AES/CBC for confidentiality of sensitive strings. Use an authenticated encryption mode (AEAD) or otherwise add proper authentication (e.g., switch to AES-GCM or another authenticated cipher) to prevent known-plaintext and forgery attacks.
linqi encryption_mode = use authenticated encryption / avoid unauthenticated AES/CBC - Compensating control
Restrict local access to systems running linqi (limit local accounts, tighten host access controls, and restrict access to management interfaces) to reduce the risk from an attacker with local access who could leverage these weaknesses.
- Operational
Rotate any credentials and secrets that may have been exposed (for example, database credentials in ConnectionString values in appsettings.json and any keys used for obfuscation). Replace secrets after fixing key storage and IV/encryption issues.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11347?
The severity of CVE-2026-11347 is high with a CVSS score of 8.5.
How do I fix CVE-2026-11347?
To fix CVE-2026-11347, remove hardcoded cryptographic keys and implement a secure random number generator for IV generation.
What vulnerabilities does CVE-2026-11347 introduce?
CVE-2026-11347 introduces vulnerabilities related to hardcoded cryptographic keys and weak IV generation, making the application susceptible to known-plaintext attacks.
Who is affected by CVE-2026-11347?
The CVE-2026-11347 vulnerability affects users of the Linqi application that rely on its cryptographic functions.
What type of attack can exploit CVE-2026-11347?
CVE-2026-11347 can be exploited through known-plaintext attacks due to the use of weak IV generation and hardcoded keys.