CVE-2026-54554 FOG adInfo endpoint is reported to disclose the Active Directory join password
Unauthenticated attackers can retrieve the Active Directory join password via the adInfo endpoint, exposing domain credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54554?
CVE-2026-54554 is a high-severity vulnerability in fogproject, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.
Weakness: CWE-200
Which versions are affected by CVE-2026-54554?
How do I fix CVE-2026-54554?
No fix has been published for CVE-2026-54554 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-54554 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54554 exists.
Sources
Also known as GHSA-q9gc-h2qc-qmx8.