CVE-2026-2237 Information disclosure in Storage Manager
Local users on Windows can obtain sensitive information from volume encryption query strings in Synology Storage Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2237?
CVE-2026-2237 is a medium-severity vulnerability in Synology Storage Manager, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information.
Weakness: CWE-598
Which versions are affected by CVE-2026-2237?
It affects 1 product.
Products include Synology Storage Manager.
How do I fix CVE-2026-2237?
No fix has been published for CVE-2026-2237 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-2237 being exploited?
There is no known exploitation of CVE-2026-2237 in the wild and no public exploit code.
Sources
Also known as GHSA-5v68-527q-prqv.