CVE-2026-44478: hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token
hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the unauthenticated POST /v1/onboarding/config endpoint by checking onboardingCompleted and canReRunOnboarding before allowing config overwrites. However, GET /v1/onboarding/config still leaks all infrastructure secrets in plaintext to unauthenticated users when the ONBOARDINGRECOVERYTOKEN stored in the database is an empty string. This vulnerability is fixed in 2026.4.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44478?
The severity of CVE-2026-44478 is classified as high due to the potential for unauthorized access to sensitive configuration data.
How do I fix CVE-2026-44478?
To fix CVE-2026-44478, update to Hoppscotch version 2026.4.0 or later, which includes the necessary security enhancements.
What is CVE-2026-44478?
CVE-2026-44478 is a vulnerability in Hoppscotch that allows unauthenticated access to onboarding configuration data via an empty recovery token.
What versions of Hoppscotch are affected by CVE-2026-44478?
Versions of Hoppscotch up to but not including 2026.4.0 are affected by CVE-2026-44478.
Can CVE-2026-44478 lead to further exploitation?
Yes, CVE-2026-44478 can potentially lead to further exploitation if attackers gain access to system configuration through the disclosed endpoint.