CVE-2026-41219: BIG-IP QKView Information Disclosure

CVE-2026-41219 Overview

CVE-2026-41219 is an improper sanitization vulnerability in the F5 BIG-IP QKView utility. The flaw allows a low-privileged authenticated attacker to read sensitive information embedded in a QKView diagnostic file. QKView is a diagnostic snapshot tool used by F5 administrators and support staff to capture system configuration and runtime state for troubleshooting. The vulnerability is classified under CWE-532: Insertion of Sensitive Information into Log File. F5 notes that software versions which have reached End of Technical Support (EoTS) are not evaluated under this advisory.

Critical Impact

A low-privileged attacker with network access to BIG-IP can extract sensitive information from QKView output, exposing data that should be redacted during diagnostic collection.

Affected Products

• F5 BIG-IP (QKView utility)
• Supported BIG-IP versions documented in F5 advisory K000157895
• End of Technical Support (EoTS) versions are not evaluated

Discovery Timeline

• 2026-05-13 - CVE-2026-41219 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-41219

Vulnerability Analysis

The QKView utility on BIG-IP generates a compressed diagnostic archive that bundles configuration files, logs, and system state. F5 designs QKView to redact sensitive material such as credentials, private keys, and tokens before the archive is finalized. CVE-2026-41219 stems from incomplete sanitization in this redaction process. Sensitive values remain present in the generated archive and become accessible to users with low privileges. The vulnerability is reachable over the network and does not require user interaction. An authenticated attacker with limited rights on the device can request or retrieve a QKView and parse its contents for unredacted secrets.

Root Cause

The root cause is improper sanitization within the QKView generation logic. The utility writes diagnostic data to output files without consistently stripping or masking confidential fields, matching the pattern described by CWE-532. Information that should never leave administrative trust boundaries persists in the archive.

Attack Vector

The attacker must hold a low-privileged account on the BIG-IP system. With that access, the attacker triggers or downloads a QKView file and inspects it for secrets such as credentials, certificates, or configuration values intended for higher-privileged roles. Refer to F5 advisory K000157895 for component-level detail on the affected workflows.

Detection Methods for CVE-2026-41219

Indicators of Compromise

• Unexpected QKView generation requests initiated by non-administrative accounts.
• Downloads of .qkview archives from BIG-IP management interfaces by low-privileged users.
• Outbound transfer of QKView files to systems outside designated support workflows.

Detection Strategies

• Audit BIG-IP audit and secure logs for QKView invocations tied to low-privileged user identities.
• Correlate file access events for /var/tmp/*.qkview and related staging paths against role assignments.
• Inspect management plane HTTPS traffic for retrieval of QKView archives by accounts outside the support role.

Monitoring Recommendations

• Forward BIG-IP audit logs to a centralized analytics platform and alert on QKView activity by non-admin roles.
• Track creation, access, and deletion of QKView files with file integrity monitoring on the BIG-IP host.
• Review F5 advisory K000157895 for vendor-published indicators and apply matching detections.

How to Mitigate CVE-2026-41219

Immediate Actions Required

• Apply the fixed BIG-IP versions identified in F5 advisory K000157895.
• Restrict QKView generation and download privileges to administrator-only roles.
• Rotate any credentials, API tokens, or keys that may have been exposed through prior QKView archives.

Patch Information

F5 has published remediation guidance and fixed software versions in advisory K000157895. Versions that have reached End of Technical Support are not covered by the fix; affected operators on those versions must upgrade to a supported branch. Confirm the running version with tmsh show sys version before and after patching.

Workarounds

• Remove the QKView role from low-privileged users and limit access to the Administrator role.
• Treat existing QKView archives as sensitive and store them only on access-controlled systems.
• Delete stale QKView files from BIG-IP and any support staging locations after use.

# Restrict QKView role assignments and audit existing files
tmsh list auth user one-line | grep -v Administrator
find /var/tmp -name '*.qkview' -exec ls -l {} \;
find /var/tmp -name '*.qkview' -mtime +1 -delete