CVE-2026-54554: FOG adInfo endpoint is reported to disclose the Active Directory join password
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOGto a version that resolves this vulnerability.Fixed in 1.5.10.1870
Event History
Frequently Asked Questions
Which FOG deployments are affected?
FOG versions prior to 1.5.10.1870 are affected. The issue concerns deployments where the FOG_AD_DEFAULT_PASSWORD value is configured, because that value could be returned as the domainpass field.
Does exploitation require a FOG login or other credentials?
No. The adInfo() endpoint was reported to be dispatchable through node=ipxe without an authenticated session, allowing a remote unauthenticated requester to obtain the response.
What should be done if the exposed password may have been retrieved?
Upgrade FOG to version 1.5.10.1870 or later. Because the issue could disclose the default Active Directory domain-join credential, replace that credential if exposure is suspected.
How can administrators assess whether their instance was vulnerable?
Check whether the FOG version is earlier than 1.5.10.1870 and whether FOG_AD_DEFAULT_PASSWORD was configured. Vulnerable responses reportedly included that value in the domainpass JSON field from the adInfo() endpoint.