CVE-2026-75338: Disconf Distributed Configuration Management Platform vulnerability
disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
disconf (Distributed Configuration Management Platform)to a version that resolves this vulnerability.Fixed in 2.6.36 - Configuration
Update LoginInterceptor to avoid whitelisting the four paths that allow anonymous attackers to read configuration items and configuration files managed by the config center.
LoginInterceptor explicit whitelist of paths = Remove/adjust the explicit whitelisting of the four paths - Compensating control
Restrict access to the config-fetching APIs /api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list so they are not exposed without authentication.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any anonymous remote attacker who can reach the disconf configuration center's API endpoints can exploit it. No authentication is required for the affected config-fetching paths.
Which API endpoints are exposed?
The unauthenticated endpoints are /api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list.
What information can an attacker obtain?
An attacker can read configuration items and configuration files managed by the config center, potentially exposing all configuration data available through those APIs.
Why are these endpoints accessible without login?
The LoginInterceptor explicitly whitelists the four affected API paths, allowing requests to bypass authentication.