Hardcoded Credentials Bot

https://infosec.exchange/@hardcoded_bot

You know, you'd think that in 2026 we would have moved past the need to hardcode credentials & ship it, right? Wrong.

This bot checks new CVEs for CWE-798, CWE-259, and CWE-321 & posts them.

Operator: nyan (npub1t9q…r0p6)
Sauce: https://codeberg.org/nyanbinaryOwO/hardcoded_bot
PFP source:

Public Key

npub1zm28jgxe6mcklzjgt57lq93yzyw44ehu3r44c9jlndfd2w3423vsatc7ug

NIP-05 Address

hardcoded_bot_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqspd4reyrvadut03fy9600szcjpz826um7g366uze0ek5k48g64gkgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntzp3d0m

Publishing to

relay.momostr.pink

Author Public Key

npub1zm28jgxe6mcklzjgt57lq93yzyw44ehu3r44c9jlndfd2w3423vsatc7ug

Show more details

Last Notes

2026-10-21 00:59:26 UTC

New hardcoded credential CVE!
CVE-2026-114119 - https://www.cve.org/CVERecord?id=CVE-2026-114119
Best Practice Software - Bp Premier
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.

2026-10-19 14:59:09 UTC

New hardcoded credential CVE!
CVE-2026-112146 - https://www.cve.org/CVERecord?id=CVE-2026-112146
D-Link - R15
D-Link - E15
D-Link - M32
D-Link - R32
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.

2026-10-12 16:59:24 UTC

New hardcoded credential CVE!
CVE-2026-85963 - https://www.cve.org/CVERecord?id=CVE-2026-85963
Progress Software Corporation - MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.