Hardcoded Credentials Bot

You know, you'd think that in 2026 we would have moved past the need to hardcode credentials & ship it, right? Wrong.

This bot checks new CVEs for CWE-798, CWE-259, and CWE-321 & posts them.

Operator: nyan (npub1t9q…r0p6)
Sauce: https://codeberg.org/nyanbinaryOwO/hardcoded_bot
PFP source:

Public Key

npub1zm28jgxe6mcklzjgt57lq93yzyw44ehu3r44c9jlndfd2w3423vsatc7ug

NIP-05 Address

hardcoded_bot_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqspd4reyrvadut03fy9600szcjpz826um7g366uze0ek5k48g64gkgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqy28wumn8ghj7un9d3shjtnyv9kh2uewd9hssfnvrr

Publishing to

relay.momostr.pink

relay.damus.io

nostr-pub.wellorder.net

Author Public Key

npub1zm28jgxe6mcklzjgt57lq93yzyw44ehu3r44c9jlndfd2w3423vsatc7ug

Show more details

Last Notes

2026-10-30 15:00:05 UTC

New hardcoded credential CVE!
CVE-2026-61729 - https://www.cve.org/CVERecord?id=CVE-2026-61729
socfortress - CoPilot
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `verify_graylog_header` in `backend/app/active_response/routes/graylog.py` and `verify_velociraptor_header` in `backend/app/incidents/routes/incident_alert.py` authenticate webhooks against `GRAYLOG_API_HEADER_VALUE` and `VELOCIRAPTOR_API_HEADER_VALUE` with the same publicly hardcoded fallback. The same default is shipped in `.env.example`. Deployments that leave either setting unset or unchanged permit an anonymous caller with the known header value to bypass the JWT authentication required by normal APIs. `POST /api/graylog/invoke` forwards attacker-selected `COMMAND`, `ACTION`, `VALUE` and `AGENT_ID` to the configured Wazuh manager without the command-enum validation of the authenticated invocation route, allowing active-response scripts to disrupt endpoints and manipulate defensive controls. `POST /api/incidents/alerts/create/threshold` and `POST /api/incidents/alerts/create/velo-sigma` accept forged alerts for arbitrary `customer_code` values and drive attacker-controlled OpenSearch queries. Active-response delivery requires a configured reachable Wazuh manager. Deployments with independently changed header secrets are not subject to this default-secret bypass. This issue is fixed in version 0.1.76.

2026-10-26 20:00:03 UTC

New hardcoded credential CVE!
CVE-2014-125135 - https://www.cve.org/CVERecord?id=CVE-2014-125135
n/a - OctoPrint
A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key
. The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded.

2026-10-26 17:00:21 UTC

New hardcoded credential CVE!
CVE-2026-71456 - https://www.cve.org/CVERecord?id=CVE-2026-71456
Johnson Controls - Kantech Entrapass
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.
This issue affects Kantech Entrapass: before 9.20.

2026-10-21 00:59:26 UTC

New hardcoded credential CVE!
CVE-2026-114119 - https://www.cve.org/CVERecord?id=CVE-2026-114119
Best Practice Software - Bp Premier
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.

2026-10-20 00:59:12 UTC

New hardcoded credential CVE!
CVE-2026-109126 - https://www.cve.org/CVERecord?id=CVE-2026-109126
IBM - Security Verify Access
IBM - Verify Identity Access
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

2026-10-19 14:59:09 UTC

New hardcoded credential CVE!
CVE-2026-112146 - https://www.cve.org/CVERecord?id=CVE-2026-112146
D-Link - R15
D-Link - E15
D-Link - M32
D-Link - R32
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.

2026-10-16 14:59:23 UTC

New hardcoded credential CVE!
CVE-2026-107617 - https://www.cve.org/CVERecord?id=CVE-2026-107617
Guangzhou Juan IoT Technology Co., Ltd. - EseeCloud App
Guangzhou Juan IoT Technology Co., Ltd. - EseeCloud Firmware
An attacker can use a hard-coded credential to log in to EseeCloud devices.

2026-10-14 07:59:10 UTC

New hardcoded credential CVE!
CVE-2026-107171 - https://www.cve.org/CVERecord?id=CVE-2026-107171
Trellix - Trellix Agent
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.

2026-10-13 19:59:17 UTC

New hardcoded credential CVE!
CVE-2026-81964 - https://www.cve.org/CVERecord?id=CVE-2026-81964
Microsoft - Windows Server 2025
Microsoft - Windows 10 Version 22H2
Microsoft - Windows 10 Version 21H2
Microsoft - Windows Server 2022
Microsoft - Windows 11 Version 24H2
Microsoft - Windows Server 2025 (Server Core installation)
Microsoft - Windows 11 Version 23H2
Microsoft - Windows 11 Version 25H2
Microsoft - Windows 11 version 23H2
Microsoft - Windows 11 Version 26H2
Microsoft - Windows 11 version 26H1
Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally.

2026-10-12 16:59:24 UTC

New hardcoded credential CVE!
CVE-2026-85963 - https://www.cve.org/CVERecord?id=CVE-2026-85963
Progress Software Corporation - MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.

2026-10-11 13:59:09 UTC

New hardcoded credential CVE!
CVE-2026-108584 - https://www.cve.org/CVERecord?id=CVE-2026-108584
FunnyWolf - Viper
A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

2026-10-11 12:58:56 UTC

New hardcoded credential CVE!
CVE-2026-108753 - https://www.cve.org/CVERecord?id=CVE-2026-108753
agnaistic - agnai
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.

2026-10-08 21:59:33 UTC

New hardcoded credential CVE!
CVE-2026-84891 - https://www.cve.org/CVERecord?id=CVE-2026-84891
IBM - Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials.

2026-10-06 19:59:14 UTC

New hardcoded credential CVE!
CVE-2026-103778 - https://www.cve.org/CVERecord?id=CVE-2026-103778
Dell - Command | Configure (DCC)
Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

2026-10-06 15:59:05 UTC

New hardcoded credential CVE!
CVE-2026-61421 - https://www.cve.org/CVERecord?id=CVE-2026-61421
Dell - Container Storage Modules
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

2026-10-01 16:59:34 UTC

New hardcoded credential CVE!
CVE-2026-13043 - https://www.cve.org/CVERecord?id=CVE-2026-13043
WatchGuard - Endpoint Security
A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory.

2026-10-01 15:59:40 UTC

New hardcoded credential CVE!
CVE-2026-67104 - https://www.cve.org/CVERecord?id=CVE-2026-67104
HCL Software - HCL BigFix Service Management
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation.

2026-09-28 16:38:56 UTC

New hardcoded credential CVE!
CVE-2026-76708 - https://www.cve.org/CVERecord?id=CVE-2026-76708
Hewlett Packard Enterprise (HPE) - ALE
A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials.
Successful exploitation could result in an attacker gaining unauthorized access to the application's management interface and the underlying operating system, potentially leading to full system compromise.

2026-09-28 16:38:53 UTC

New hardcoded credential CVE!
CVE-2026-70413 - https://www.cve.org/CVERecord?id=CVE-2026-70413
Dell - Live Optics Collector
Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

2026-09-28 16:38:50 UTC

New hardcoded credential CVE!
CVE-2026-18181 - https://www.cve.org/CVERecord?id=CVE-2026-18181
IBM - Financial Transaction Manager (FTM) for RedHat OpenShift
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key.

2026-09-23 14:57:01 UTC

New hardcoded credential CVE!
CVE-2018-25069 - https://www.cve.org/CVERecord?id=CVE-2018-25069
Netis - Netcore Router
A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The identifier VDB-217593 was assigned to this vulnerability.