CVE-2026-39039: BharatMLStack Information Disclosure Flaw

CVE-2026-39039 Overview

CVE-2026-39039 affects Meesho BharatMLStack up to and including version v1.3.0. The Trufflebox UI component stores sensitive authentication material in the browser's localStorage. The stored data includes the JSON Web Token (JWT) authentication token, the full user object, and the session identifier. Any JavaScript executing on the page can read these values.

Attackers who achieve script execution on the origin, such as through a cross-site scripting flaw or a malicious dependency, can exfiltrate the tokens and hijack authenticated sessions. The flaw represents an insecure client-side storage design decision rather than a memory or protocol defect.

Critical Impact
Session tokens accessible to any in-page script enable full account takeover after any successful script injection.

Affected Products

Meesho BharatMLStack, all versions up to and including v1.3.0
Trufflebox UI component within BharatMLStack
Deployments exposing the Trufflebox web console to end users

Discovery Timeline

2026-09-15 - CVE-2026-39039 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-39039

Vulnerability Analysis

BharatMLStack is an open-source machine learning platform maintained by Meesho. Its Trufflebox UI provides an administrative web interface for the feature store and related services. On successful authentication, the front-end persists the issued JWT, the serialized user object, and the session ID inside the browser's localStorage API.

Data written to localStorage is not partitioned from JavaScript running in the same origin. Cookies configured with the HttpOnly attribute are unreadable to scripts, but localStorage has no equivalent protection. Any injected script, embedded advertisement, browser extension with page access, or compromised third-party dependency can read the stored tokens synchronously.

Stolen JWTs remain valid until their expiry. An attacker can replay the token from any host to authenticate against the backend API as the victim user. The exposure of the full user object also leaks role, email, and identifier fields that support further targeting.

Root Cause

The root cause is an insecure data storage pattern in the client. The application selects localStorage for long-lived credentials without applying any browser-enforced isolation. This maps to insecure storage of sensitive information on the client side, related to weaknesses tracked under CWE-922 and session management weaknesses under CWE-539.

Attack Vector

Exploitation requires code execution within the Trufflebox origin. The most common path is a reflected or stored cross-site scripting (XSS) flaw in the same application or a supply-chain compromise of a loaded JavaScript dependency. Once a script runs, a single call to localStorage.getItem retrieves the JWT and session ID, which the attacker then transmits to a controlled endpoint and reuses against the BharatMLStack API.

Refer to the GitHub CVE Writeup for BharatMLStack for the reporter's analysis and the Meesho BharatMLStack repository for source references.

Detection Methods for CVE-2026-39039

Indicators of Compromise

Outbound HTTP or WebSocket requests from browsers containing base64-encoded JWT fragments to non-BharatMLStack hosts
Unexpected successful API calls to Trufflebox endpoints originating from IP addresses that never authenticated interactively
Concurrent active sessions for the same user identifier from geographically distant source addresses
New or modified third-party JavaScript assets loaded by the Trufflebox UI

Detection Strategies

Review browser network telemetry and web application firewall logs for JWT patterns in query strings, form fields, or request bodies sent to external domains
Enable server-side JWT binding checks that compare token claims against expected source characteristics such as user agent or IP range
Instrument the Trufflebox origin with a Content Security Policy (CSP) violation reporting endpoint to surface injected script attempts
Correlate authentication events with user activity to identify token reuse from unattended sessions

Monitoring Recommendations

Alert on multiple active sessions per account when concurrent sessions are not expected by policy
Track first-seen user agents and ASNs for administrative accounts and flag deviations
Monitor for XSS payload signatures in Trufflebox input fields, including URL parameters and form submissions
Log every JWT issuance and validation event with source IP and requesting user agent for later correlation

How to Mitigate CVE-2026-39039

Immediate Actions Required

Inventory BharatMLStack deployments and identify any instance running v1.3.0 or earlier
Restrict Trufflebox UI access to trusted networks or place it behind an authenticated reverse proxy
Rotate all active JWT signing keys to invalidate previously issued tokens
Force reauthentication for every Trufflebox user and revoke lingering session identifiers

Patch Information

At the time of publication, no fixed version is referenced in the advisory. Monitor the Meesho BharatMLStack repository for a release that migrates authentication material out of localStorage. A durable fix stores the JWT in a cookie marked HttpOnly, Secure, and SameSite=Strict, and holds only non-sensitive UI state in localStorage.

Workarounds

Deploy a strict Content Security Policy on the Trufflebox origin that disallows inline scripts and restricts script sources to a fixed allowlist
Shorten JWT lifetimes and enforce short-lived refresh tokens to limit the value of stolen credentials
Terminate authentication at a reverse proxy that issues HttpOnly session cookies and strips client-visible tokens
Disable or remove unnecessary third-party JavaScript from the Trufflebox UI to reduce supply-chain risk

bash

# Example reverse-proxy header hardening for the Trufflebox origin
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;