CVE-2026-102628: Cadmos LTI Information Disclosure Flaw

CVE-2026-102628 Overview

CVE-2026-102628 is an information disclosure vulnerability affecting the Cadmos Learning Tools Interoperability (LTI) application hosted at cadmos.eummena.io. The application ran with Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible production environment. An unauthenticated remote attacker could trigger an unhandled exception with a crafted GET request. Laravel then rendered a verbose debug page exposing the full server environment, including every .env configuration variable in plaintext. The exposed data could include database credentials, API keys, mail server credentials, and application secrets. The issue was fixed on or before 2026-09-02 and is tracked under [CWE-215: Insertion of Sensitive Information Into Debugging Code].

Critical Impact
Unauthenticated attackers can retrieve the complete .env file contents, exposing credentials and secrets that enable follow-on compromise of connected services.

Affected Products

Cadmos LTI application hosted at cadmos.eummena.io
Laravel-based deployments configured with APP_DEBUG=true in production
Any environment exposing APP_ENV=local to untrusted networks

Discovery Timeline

2026-09-02 - Vulnerability fixed on or before this date
2026-10-01 - CVE-2026-102628 published to NVD
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-102628

Vulnerability Analysis

The Cadmos LTI application exposed Laravel's built-in debug error handler to the public internet. When Laravel runs with APP_DEBUG=true, the framework uses the Ignition error page (or Whoops in older versions) to display rich diagnostic output on any unhandled exception. This output includes the request context, stack trace, loaded configuration, and the complete environment variable set.

An unauthenticated attacker needs only to send a GET request that triggers any routing, validation, or application-layer exception. The resulting debug page discloses secrets stored in the .env file. These secrets typically include DB_PASSWORD, APP_KEY, MAIL_PASSWORD, third-party API tokens, and OAuth client secrets used for LTI integrations.

The EPSS score is 0.335% at the 24.79 percentile, but exploitation requires no tooling beyond a web browser. The vulnerability is categorized as information disclosure, with secondary impact extending to any system that trusts the leaked credentials.

Root Cause

The root cause is a deployment configuration flaw. The production host retained development-oriented settings (APP_DEBUG=true, APP_ENV=local) rather than the required production values (APP_DEBUG=false, APP_ENV=production). Laravel's debug handler intentionally reveals environment data to aid developers, and it does not restrict access by source address.

Attack Vector

The attack vector is unauthenticated network access. An attacker locates a Laravel endpoint, submits a request designed to produce an exception (for example, invalid route parameters, malformed input, or a nonexistent model lookup), and reads the environment variables rendered in the HTML debug response. The vulnerability requires no privileges, no user interaction, and no prior reconnaissance beyond identifying the host.

Technical details of the discovery methodology are documented in the Medium write-up by the reporting researcher and the CISA CSAF document.

Detection Methods for CVE-2026-102628

Indicators of Compromise

HTTP responses containing the strings Whoops, something went wrong, Ignition, or APP_KEY= returned from production hosts.
Access log entries containing requests designed to trigger exceptions, such as malformed route parameters or invalid JSON payloads to Laravel endpoints.
Outbound authentication attempts from unknown source addresses using credentials matching values stored in a leaked .env file.

Detection Strategies

Scan all externally reachable Laravel hosts for debug responses by submitting a known-invalid route and inspecting the response for environment variable disclosure.
Review web application firewall (WAF) and reverse proxy logs for HTTP 500 responses larger than expected, which often indicate rendered debug pages.
Audit configuration management repositories and container images for APP_DEBUG=true or APP_ENV=local entries bound for production deployments.

Monitoring Recommendations

Alert on any production response body containing environment variable names such as DB_PASSWORD, APP_KEY, or MAIL_USERNAME.
Monitor authentication logs for database, mail, and third-party API services for logins from unexpected source addresses following any suspected disclosure.
Track changes to .env files and application configuration using file integrity monitoring on all Laravel hosts.

How to Mitigate CVE-2026-102628

Immediate Actions Required

Set APP_DEBUG=false and APP_ENV=production on all externally reachable Laravel hosts and redeploy.
Rotate every credential, API key, and secret stored in the .env file, including APP_KEY, database passwords, mail credentials, and OAuth client secrets.
Review access logs covering the exposure window and investigate authentication activity on any service whose credentials appeared in the exposed configuration.
Confirm the Cadmos LTI deployment is running the fixed configuration released on or before 2026-09-02.

Patch Information

The vendor remediated the issue by disabling Laravel debug mode on the production host. The fix was applied on or before 2026-09-02. Operators of Cadmos LTI deployments should verify their instance returns a generic error page rather than a debug trace when triggering an exception. Reference the CVE record for authoritative status.

Workarounds

Place the application behind a WAF rule that blocks response bodies containing Laravel debug markers such as Whoops or Ignition.
Restrict access to the application to known IP ranges until configuration can be corrected.
Override APP_DEBUG through the hosting platform's environment variable interface when direct file edits are not possible.

bash

# Configuration example: Laravel production .env settings
APP_ENV=production
APP_DEBUG=false
APP_URL=https://cadmos.example.com

# Verify no debug output is served
curl -s -o /dev/null -w "%{http_code}\n" https://cadmos.example.com/nonexistent-route
# Expected: 404 with generic error page, not a Laravel debug trace