CVE-2026-67598 Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php
Attackers can intercept HTTPS traffic to extract API keys and inject malicious AI responses due to disabled TLS certificate validation in Emlog Pro.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67598?
CVE-2026-67598 is a critical vulnerability in emlog, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query_database and update_config tool handlers.
Weakness: CWE-295
Which versions are affected by CVE-2026-67598?
How do I fix CVE-2026-67598?
No fix has been published for CVE-2026-67598 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-67598 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67598 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-hf85-99vj-m4c5, GHSA-j63f-h5jj-qrf5.