CVE-2026-108754 Details
Description
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.
A logging vulnerability in GPT-Load versions through 1.4.11 allows for the exposure of client proxy keys. This issue arises because the Gin Logger middleware captures the raw query string before the authentication key is stripped from Gemini-style requests. As a result, attackers with access to the console logs or the application log file can retrieve these proxy keys and misuse them against the corresponding group.
Update to GPT-Load version 2.0 or later, where this vulnerability has been addressed. If an immediate update is not possible, consider manually redacting proxy keys from the query parameters before sending requests to the Gemini proxy.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tbphp/gpt-load | <= 1.4.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |