CVE-2026-39908: OpenBullet2 0.3.2 NTLMv2 Hash Disclosure via UNC Path Proxy Source
OpenBullet2 through version 0.3.2 on Windows contains a credential disclosure vulnerability that allows remote attackers to capture the NTLMv2 hash of the process user by configuring a job proxy source with a UNC path pointing to an attacker-controlled server. When the job starts, the application attempts to load proxies from the UNC path, triggering an SMB authentication attempt that discloses the NTLMv2 hash, which can then be relayed or cracked offline.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenBullet2to a version that resolves this vulnerability.Fixed in 0.3.2 - Configuration
Ensure the job proxy source is not configured with a UNC path that points to an attacker-controlled server to prevent SMB authentication and NTLMv2 hash disclosure.
OpenBullet2 (Job proxy source) proxy source UNC path = Do not use UNC paths (e.g., \\attacker-controlled-server\share)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39908?
The severity of CVE-2026-39908 is medium with a score of 6.5.
How does CVE-2026-39908 exploit work?
CVE-2026-39908 exploits a credential disclosure vulnerability by allowing remote attackers to capture the NTLMv2 hash through a configured UNC path.
What versions of OpenBullet are affected by CVE-2026-39908?
OpenBullet2 versions up to and including 0.3.2 are affected by CVE-2026-39908.
How can I fix CVE-2026-39908?
To fix CVE-2026-39908, upgrade to a version of OpenBullet2 that is beyond 0.3.2.
What kind of data is exposed by CVE-2026-39908?
CVE-2026-39908 exposes the NTLMv2 hash of the process user, which can be exploited for gaining unauthorized access.