CVE-2026-46458: Boomerang Information Disclosure Flaw

CVE-2026-46458 Overview

CVE-2026-46458 is an information disclosure vulnerability in ICU Scandinavia Boomerang. The application exposes sensitive credential files through static HTTP, allowing unauthenticated attackers to retrieve plaintext service account and Simple Mail Transfer Protocol (SMTP) credentials. Attackers request specific XML files directly from the webroot to extract these secrets. The flaw maps to [CWE-522] Insufficiently Protected Credentials. ICU Scandinavia addressed the issue in Boomerang version 2.4.18.029.

Critical Impact
Unauthenticated attackers on the adjacent network can retrieve plaintext service account and SMTP credentials, enabling lateral movement and abuse of email infrastructure.

Affected Products

ICU Scandinavia Boomerang versions prior to 2.4.18.029
Boomerang Quality Assurance Lab deployments exposing the webroot over HTTP
Any Boomerang instance retaining default XML credential files in the webroot

Discovery Timeline

2026-07-15 - CVE CVE-2026-46458 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-46458

Vulnerability Analysis

The vulnerability stems from ICU Scandinavia Boomerang serving XML configuration files containing credentials as static HTTP resources. These files reside within the webroot and lack access controls. Any client that can reach the HTTP service can request the files by known filenames and receive their contents in plaintext.

The disclosed material includes service account credentials and SMTP credentials. An attacker who obtains service account credentials can authenticate to backend systems as a trusted identity. SMTP credentials enable outbound email abuse, including phishing campaigns launched from a trusted domain.

The attack requires no authentication, no user interaction, and low complexity. Exploitation is limited to the adjacent network as reflected in the CVSS attack vector.

Root Cause

The root cause is improper access control on sensitive files placed inside the HTTP document root. Configuration files that store secrets should reside outside the webroot or be blocked by server-level access rules. Boomerang shipped these XML files in a location the web server treated as static content, meaning the server returned the raw file bytes on request.

Attack Vector

An attacker on the adjacent network sends an HTTP GET request to the Boomerang web server targeting the known XML credential filenames. The server returns the file contents without authentication checks. The attacker parses the XML to extract service account and SMTP credentials, then reuses them against other systems.

No proof-of-concept code is publicly published. Refer to the CERT Polska advisory for CVE-2026-46458 for further technical context.

Detection Methods for CVE-2026-46458

Indicators of Compromise

HTTP GET requests from unexpected sources targeting XML files in the Boomerang webroot
Successful 200 OK responses for static XML resources containing credential fields
Unusual authentication attempts using service accounts referenced in Boomerang configuration
Outbound SMTP traffic or authenticated SMTP sessions originating from unrecognized hosts using Boomerang SMTP credentials

Detection Strategies

Review web server access logs for requests to .xml files served from the Boomerang webroot
Alert on any external or non-administrative host requesting configuration files by name
Correlate service account authentication events with the source addresses that queried the Boomerang HTTP endpoint
Monitor SMTP authentication logs for use of Boomerang-managed accounts from unexpected IP addresses

Monitoring Recommendations

Enable verbose HTTP access logging on all Boomerang hosts and forward logs to a centralized log store
Baseline normal request patterns for the Boomerang webroot and alert on deviations
Rotate credentials found in Boomerang XML files and monitor for reuse of prior credentials

How to Mitigate CVE-2026-46458

Immediate Actions Required

Upgrade ICU Scandinavia Boomerang to version 2.4.18.029 or later
Rotate all service account and SMTP credentials that were stored in Boomerang XML files
Restrict network access to the Boomerang HTTP service to trusted management networks
Audit web server logs for prior requests to the affected XML files to determine potential compromise

Patch Information

ICU Scandinavia has released version 2.4.18.029 of Boomerang, which resolves the exposure of credential XML files over static HTTP. Administrators should apply the update on all Boomerang installations. Confirm the fix by verifying that direct HTTP requests to the previously exposed XML filenames no longer return credential content. See the ICU Scandinavia Boomerang Quality Assurance overview for product information.

Workarounds

Configure the web server to deny HTTP access to .xml files within the Boomerang webroot until the patch is applied
Move credential files outside the document root and update Boomerang to reference the new location if supported
Place the Boomerang HTTP service behind a reverse proxy that enforces authentication and IP allowlisting

bash

# Example nginx location rule to block static XML retrieval from the Boomerang webroot
location ~* \.xml$ {
    deny all;
    return 403;
}