CVE-2026-67598: Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php
Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and CURLOPTSSLVERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the querydatabase and updateconfig tool handlers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Emlog Proto a version that resolves this vulnerability.Fixed in 2.6.23 - Configuration
Enable TLS certificate verification in include/service/ai.php; do not unconditionally disable CURLOPT_SSL_VERIFYPEER (it is described as unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml()).
Emlog Pro (include/service/ai.php) CURLOPT_SSL_VERIFYPEER = enabled - Configuration
Enable TLS hostname verification in include/service/ai.php; do not unconditionally disable CURLOPT_SSL_VERIFYHOST (it is described as unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml()).
Emlog Pro (include/service/ai.php) CURLOPT_SSL_VERIFYHOST = enabled - Compensating control
Use a network control to prevent network-adjacent man-in-the-middle interception of outbound HTTPS requests to the configured LLM providers (e.g., restrict egress/route traffic so attackers cannot present arbitrary TLS certificates).
- Operational
If Authorization Bearer API keys may have been intercepted before TLS verification was corrected, rotate those exposed keys.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67598?
CVE-2026-67598 has a high severity score of 7.4.
How do I fix CVE-2026-67598?
To fix CVE-2026-67598, update Emlog Pro to a version above 2.6.23 that enables TLS certificate validation.
What vulnerabilities are associated with CVE-2026-67598?
CVE-2026-67598 allows network-adjacent attackers to intercept outbound HTTPS requests due to disabled TLS certificate validation.
Who is affected by CVE-2026-67598?
CVE-2026-67598 affects users of Emlog Pro version 2.6.23 and earlier.
What components are involved in CVE-2026-67598?
CVE-2026-67598 involves the ai.php file in the Emlog Pro application.