CVE-2026-44478 hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token
Unauthenticated attackers can retrieve infrastructure secrets via the onboarding config endpoint when the recovery token is empty.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44478?
CVE-2026-44478 is a high-severity vulnerability in hoppscotch, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the unauthenticated POST /v1/onboarding/config endpoint by checking onboardingCompleted and canReRunOnboarding before allowing config overwrites. However, GET /v1/onboarding/config still leaks all infrastructure secrets in plaintext to unauthenticated users when the ONBOARDING_RECOVERY_TOKEN stored in the database is an empty string. This vulnerability is fixed in 2026.4.0.
Which versions are affected by CVE-2026-44478?
How do I fix CVE-2026-44478?
No fix has been published for CVE-2026-44478 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-44478 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44478 exists.
Sources
Also known as GHSA-7c8p-hj4p-3q3f.