CVE-2026-78553 Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook
Local attackers can read insecurely stored Flask secret keys to forge session cookies and impersonate administrators in RansomLook.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-78553?
CVE-2026-78553 is a high-severity vulnerability in ransomlook, published on 24 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access the RansomLook home directory could read the application's cryptographic secret.
The exposed key is security-critical because it is used to sign Flask session cookies and is also involved in the legacy API-key key derivation. An attacker who obtains the key can generate valid session cookies and impersonate an authenticated user, including an administrator. In LDAP configurations, exploitation may be particularly straightforward because the session user loader does not require the supplied username to correspond to an existing local user.
Successful exploitation requires local access sufficient to read the improperly protected file, but can result in complete compromise of RansomLook's authentication and authorization controls.
The patch creates new secret-key files atomically with permissions 0600 and also restricts permissions on existing key files during application startup.
Which versions are affected by CVE-2026-78553?
How do I fix CVE-2026-78553?
No fix has been published for CVE-2026-78553 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-78553 being exploited?
There is no known exploitation of CVE-2026-78553 in the wild and no public exploit code.
Sources
Also known as GHSA-5453-gcx7-h56m.