CVE-2026-39039: BharatMLStack / Trufflebox UI vulnerability

Q: What must an attacker be able to do to obtain the stored credentials?

An attacker needs JavaScript execution in the Trufflebox UI page context, such as through a cross-site scripting issue or another mechanism that runs script on the page. Any JavaScript running there can access the JWT, full user object, and session ID in localStorage.

Q: Which deployments are known to be affected?

BharatMLStack Trufflebox UI versions up to and including v1.3.0 are affected.

Q: How can I check whether an instance exposes this data?

In a browser session using Trufflebox UI, inspect the site's localStorage through browser developer tools. The affected behavior is the presence of a JWT authentication token, full user object, and session ID in localStorage.

Published Sep 15, 2026

Updated

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.

Affected Software

1 affected component

BharatMLStack / Trufflebox UI<=v1.3.0

Event History

Sep 15, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What must an attacker be able to do to obtain the stored credentials?

An attacker needs JavaScript execution in the Trufflebox UI page context, such as through a cross-site scripting issue or another mechanism that runs script on the page. Any JavaScript running there can access the JWT, full user object, and session ID in localStorage.

Which deployments are known to be affected?

BharatMLStack Trufflebox UI versions up to and including v1.3.0 are affected.

How can I check whether an instance exposes this data?

In a browser session using Trufflebox UI, inspect the site's localStorage through browser developer tools. The affected behavior is the presence of a JWT authentication token, full user object, and session ID in localStorage.