CVE-2026-22890: Ev2go.io Information Disclosure Flaw

CVE-2026-22890 Overview

CVE-2026-22890 is a vulnerability affecting EV2Go's ev2go.io platform where charging station authentication identifiers are publicly accessible via web-based mapping platforms. This information disclosure vulnerability could allow unauthorized actors to obtain sensitive authentication credentials that should be protected, potentially enabling unauthorized access to EV charging infrastructure.

Critical Impact

Exposure of charging station authentication identifiers through public mapping platforms could enable unauthorized access to EV charging infrastructure, billing fraud, or manipulation of charging sessions.

Affected Products

• ev2go ev2go.io (all versions)

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-22890 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-22890

Vulnerability Analysis

This vulnerability falls under CWE-522 (Insufficiently Protected Credentials), indicating that the affected EV2Go platform fails to adequately protect authentication identifiers used by EV charging stations. The core issue stems from the exposure of these credentials through publicly accessible web-based mapping interfaces, where they can be harvested by malicious actors without requiring any authentication or special access privileges.

The vulnerability is network-accessible and requires no user interaction or special privileges to exploit. An attacker can simply access the public mapping platform to retrieve the exposed authentication identifiers. While the immediate impact is limited to information disclosure affecting confidentiality and integrity, the downstream consequences could be significant for EV charging infrastructure operators and users.

Root Cause

The root cause of CVE-2026-22890 is the improper handling of sensitive authentication credentials in the EV2Go platform's architecture. Charging station authentication identifiers, which should be treated as confidential data, are being exposed through public-facing mapping interfaces. This represents a fundamental design flaw where security-sensitive information is inadvertently included in publicly accessible data feeds or API responses.

Attack Vector

The attack vector for this vulnerability is network-based with low complexity. An attacker can exploit this vulnerability remotely by:

1. Accessing the publicly available web-based mapping platform associated with EV2Go charging stations
2. Enumerating or browsing charging station locations through the mapping interface
3. Extracting authentication identifiers that are improperly exposed in the station data
4. Potentially using these credentials to interact with charging infrastructure in unauthorized ways

The vulnerability does not require authentication, user interaction, or any elevated privileges to exploit, making it accessible to any network-based attacker with knowledge of the mapping platform.

Detection Methods for CVE-2026-22890

Indicators of Compromise

• Unusual access patterns to charging station mapping APIs or data endpoints
• Bulk enumeration of charging station records from single source IPs
• Authentication attempts using credentials harvested from public sources
• Anomalous geographic access patterns to charging infrastructure management systems

Detection Strategies

• Monitor API access logs for high-volume requests to station location or configuration endpoints
• Implement rate limiting and anomaly detection on public-facing mapping interfaces
• Track authentication failures and successful authentications from unexpected sources
• Correlate access to mapping data with subsequent authentication attempts to charging infrastructure

Monitoring Recommendations

• Enable detailed logging on all charging station management interfaces
• Deploy network monitoring to detect reconnaissance activity against EV infrastructure
• Establish baseline access patterns for legitimate mapping platform usage
• Configure alerts for credential usage anomalies or unauthorized access attempts

How to Mitigate CVE-2026-22890

Immediate Actions Required

• Audit all public-facing mapping platform data to identify exposed authentication credentials
• Remove or obfuscate authentication identifiers from publicly accessible interfaces
• Rotate any authentication credentials that may have been exposed
• Implement access controls to restrict sensitive station data to authorized users only

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-26-057-04 for official remediation guidance. Additional technical details are available in the GitHub CSAF Document. Contact EV2Go directly through their official website for vendor-specific patch information and updates.

Workarounds

• Implement network segmentation to isolate charging station management systems from public interfaces
• Deploy API gateways with strict access controls between mapping platforms and backend systems
• Use tokenized or hashed identifiers in public interfaces instead of actual authentication credentials
• Consider temporarily restricting public access to detailed station information until credentials are properly protected

# Example: Restrict API access to authenticated users only
# Add to web server configuration to require authentication for sensitive endpoints
# Consult vendor documentation for platform-specific implementation