CVE-2026-104384 Details
Description
Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access the access keys, secret keys, and deployment secrets
A vulnerability allowing the exposure of sensitive infrastructure credentials exists in EagleCloud Aquila on-premises versions prior to 2.6.7.2. This issue is present in the tunnel gateway and provisioning interfaces, where insufficient protection of credentials allows unauthenticated remote attackers to access high-privilege deployment keys, secret keys, and other sensitive credentials from public-facing endpoints. The vulnerability arises from insecure handling of API inputs, enabling unauthorized access to critical authentication details that can be exploited to impersonate administrative users and bypass security proxies.
Users can upgrade to EagleCloud Aquila version 2.6.7.3 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0040.md | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EagleCloud Aquila | <= 2.6.7.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |