CVE-2026-94592 Armatura LLC Armatura One Use of Hard-coded Credentials
Attackers with local access can use hard-coded database superuser credentials to gain elevated privileges and read data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94592?
CVE-2026-94592 is a high-severity vulnerability in Armatura One, published on 2 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can authenticate as the database superuser on a deployment where it has not been changed.
Weakness: CWE-798
Which versions are affected by CVE-2026-94592?
How do I fix CVE-2026-94592?
No fix has been published for CVE-2026-94592 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-94592 being exploited?
There is no known exploitation of CVE-2026-94592 in the wild and no public exploit code.
Sources
Also known as GHSA-rq48-r7v8-mfh6.