CVE-2026-125377 Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125377?
CVE-2026-125377 is a high-severity vulnerability in pig-mesh pig, published on 9 Nov 2026.
Official description
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.
Weakness: CWE-862
Which versions are affected by CVE-2026-125377?
How do I fix CVE-2026-125377?
No fix has been published for CVE-2026-125377 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125377 being exploited?
There is no known exploitation of CVE-2026-125377 in the wild and no public exploit code.
Sources
Also known as GHSA-9mr9-9xmv-5w3c.