CVE-2026-92759: SecObserve before 1.59.1 Information Disclosure via API Configuration
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basicauthpassword field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SecObserveto a version that resolves this vulnerability.Fixed in 1.59.1 - Compensating control
Restrict access to SecObserve REST endpoints so view-only product members cannot retrieve decrypted basic-auth passwords returned by ApiConfigurationSerializer (e.g., limit API access/roles to authorized administrators only).
Event History
Frequently Asked Questions
Who can retrieve the exposed credentials?
View-only product members can retrieve decrypted basic-auth passwords for configured scanner or integration service accounts through standard REST endpoints. Exploitation requires network access and low-privileged authenticated access; no user interaction is required.
Which deployments are affected?
SecObserve versions before 1.59.1 are affected. The issue applies where API configurations contain a basic_auth_password value for a scanner or integration service account.
How can I determine whether credentials may have been exposed?
Review whether view-only members had access to the affected REST endpoints and whether API configurations included basic-auth passwords. Because the password is returned decrypted in API configuration responses, treat configured service-account passwords as potentially disclosed to those members.