CVE-2026-100377: MediaWiki WikiLambda Information Disclosure

CVE-2026-100377 Overview

CVE-2026-100377 is an information disclosure vulnerability in the Wikimedia Foundation's MediaWiki WikiLambda Extension. The flaw allows unauthorized actors to retrieve sensitive information through a technique classified under [CWE-200]. The issue affects WikiLambda Extension version 1.47.0-alpha and has been remediated on the master branch. Attackers can exploit the vulnerability over the network without authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can enumerate sensitive data exposed by the WikiLambda Extension, enabling reconnaissance against affected MediaWiki deployments.

Affected Products

Wikimedia Foundation MediaWiki WikiLambda Extension 1.47.0-alpha
MediaWiki installations running the vulnerable WikiLambda Extension branch
Self-hosted wikis integrating WikiLambda prior to the master branch fix

Discovery Timeline

2026-09-25 - CVE-2026-100377 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100377

Vulnerability Analysis

The WikiLambda Extension exposes sensitive information to unauthorized actors through an excavation-style access pattern. The extension integrates abstract function evaluation into MediaWiki, exposing API endpoints that return data about functions, implementations, and tests. Insufficient authorization checks on these endpoints allow an unauthenticated attacker to probe and extract data that should remain restricted. The vulnerability maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. The upstream fix landed on the master branch per the Wikimedia Gerrit Change Proposal.

Root Cause

The root cause is missing or inadequate access control on data-returning paths within the extension. When requests reach the vulnerable handlers, the extension returns responses without verifying that the caller is authorized to view the underlying objects. Discussion of the defect is tracked in Wikimedia Task T430601.

Attack Vector

An attacker reaches the vulnerable endpoints over the network. No credentials, privileges, or user interaction are required. The attacker issues crafted HTTP requests to WikiLambda endpoints to enumerate and retrieve exposed data. Confidentiality is impacted; integrity and availability are not affected per the CVSS vector.

No verified exploit code is published. See the Wikimedia Gerrit Change Proposal for the authoritative description of the vulnerable code paths and the applied fix.

Detection Methods for CVE-2026-100377

Indicators of Compromise

Unusual volumes of unauthenticated requests to WikiLambda API endpoints under /w/api.php with action parameters referencing WikiLambda modules.
Sequential or scripted enumeration of ZObject identifiers in access logs originating from a single source address.
Anomalous outbound responses with sizes inconsistent with normal public API traffic patterns.

Detection Strategies

Audit MediaWiki access logs for anonymous requests to WikiLambda endpoints and correlate request frequency per source IP.
Compare installed WikiLambda Extension version against the patched master branch commit referenced in Gerrit.
Alert on API responses that return object metadata to unauthenticated sessions where authentication should be required.

Monitoring Recommendations

Enable verbose logging on MediaWiki API handlers associated with WikiLambda and forward logs to a centralized analytics platform.
Track baselines for anonymous API request volume and alert on deviations.
Review web application firewall telemetry for repeated enumeration patterns targeting WikiLambda routes.

How to Mitigate CVE-2026-100377

Immediate Actions Required

Update the WikiLambda Extension to a build that includes the master branch remediation referenced in Wikimedia Gerrit Change Proposal.
Inventory all MediaWiki instances to identify deployments running version 1.47.0-alpha of the extension.
Restrict access to WikiLambda endpoints at the reverse proxy or WAF until the patch is applied.

Patch Information

The maintainers remediated the issue on the master branch of the WikiLambda repository. Operators should pull the fixed revision and redeploy. Track upstream progress through Wikimedia Task T430601.

Workarounds

Disable the WikiLambda Extension in LocalSettings.php on affected MediaWiki installations until the patched version is deployed.
Enforce authentication on the affected API routes using reverse proxy rules.
Rate-limit anonymous requests to WikiLambda endpoints to slow enumeration attempts.

bash

# Disable the WikiLambda extension in LocalSettings.php
# Comment out or remove the extension loader line
# wfLoadExtension( 'WikiLambda' );

# Example nginx rule to restrict WikiLambda API access to authenticated sessions
location ~ ^/w/api\.php {
    if ($arg_action ~* "wikilambda") {
        limit_req zone=wikilambda_zone burst=5 nodelay;
    }
}