CVE-2026-94591

HighCVSS 8.4/10Last modified Oct 6, 2026

Description

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, and can then decrypt the stored credentials of any specific installation to which the attacker separately obtains the encrypted configuration file.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-321

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 2, 2026
Last modified: Oct 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-945928.4Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, CVE-2026-945937.8Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a CVE-2026-945944.0Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any part CVE-2026-94608.8A weakness has been identified in Edimax EW-7438RPn 1.31. This impacts the function formAccept of the file /goform/formAccept. Executing a m CVE-2026-9460310.0Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.a CVE-2026-946068.9authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an CVE-2026-946098.8authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a g CVE-2026-94618.8A security vulnerability has been detected in Edimax EW-7438RPn 1.31. Affected is the function formRadius of the file /goform/formRadius. Th CVE-2026-946118.1authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credential CVE-2026-946127.4authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's s CVE-2026-946137.5authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed CVE-2026-94628.8A vulnerability was detected in Edimax EW-7438RPn 1.31. Affected by this vulnerability is the function formWpsProxyEnable of the file /gofor