CVE-2026-50641: Streamsoft BI Password Disclosure Flaw

CVE-2026-50641 Overview

CVE-2026-50641 affects Streamsoft Business Intelligence (BI), a Polish enterprise reporting and analytics platform. The application stores user passwords in plaintext form inside its backing database. Any actor with read access to the credential table can recover valid login secrets without cracking or brute-forcing them. The weakness is tracked as CWE-256: Plaintext Storage of a Password and was reported through CERT Poland. The vendor fixed the flaw in Streamsoft BI version 6.8.0.0 and required all users to reset their passwords on the next login.

Critical Impact
An adjacent-network attacker with database access can read every user password directly, enabling account takeover and lateral movement into any system where the credentials are reused.

Affected Products

Streamsoft Business Intelligence (BI) versions prior to 6.8.0.0
Deployments where the BI database is reachable from an adjacent network segment
Environments where BI users reuse credentials across other enterprise systems

Discovery Timeline

2026-07-29 - CVE-2026-50641 published to NVD following coordinated disclosure by CERT Poland
2026-07-29 - Last updated in NVD database
Fix release - Streamsoft published version 6.8.0.0 and forced a password reset at first login

Technical Details for CVE-2026-50641

Vulnerability Analysis

Streamsoft BI persists authentication secrets to its database as cleartext strings rather than as salted cryptographic hashes. Password verification therefore performs a direct string comparison against the stored value. This design decision removes every layer of defense that a modern credential store provides, including salting, key stretching, and one-way hashing.

The practical consequence is that credential confidentiality depends entirely on database access controls. Any privileged path into the database, including database administrator accounts, backup archives, read-only replicas, and SQL injection in adjacent applications, exposes the full user population. Attackers do not need offline cracking infrastructure and gain immediate authenticated access.

The attack requires network adjacency but no authentication and no user interaction. Confidentiality impact on the vulnerable component is high, while integrity and availability are not directly affected by the storage flaw itself.

Root Cause

The root cause is the absence of a password hashing scheme in the credential persistence layer. The application skipped standard practices such as bcrypt, scrypt, Argon2, or PBKDF2 and wrote raw user input to the users table. Enforcement of hashed storage was only introduced in 6.8.0.0, together with a mandatory password change to invalidate the plaintext values already on disk.

Attack Vector

An attacker positioned on the adjacent network segment where the BI database listens must obtain a read path to the credential table. Viable paths include stolen database credentials, exposed backup files, misconfigured replication endpoints, or a secondary SQL injection in software that shares the database. Once the table is read, the attacker replays the recovered passwords against the BI login page and against other corporate systems that share the same user directory.

No public proof-of-concept exploit code is required to weaponize this flaw. See the CERT Poland advisory for the disclosure detail.

Detection Methods for CVE-2026-50641

Indicators of Compromise

Unexpected SELECT statements against the Streamsoft BI users or credentials table from accounts that do not normally query it
Successful BI logins from new source IP addresses immediately followed by broad report exports or configuration changes
Database backup files (.bak, .dmp, .sql) copied to file shares, cloud storage, or removable media outside of a scheduled job
Simultaneous successful authentications for the same account against BI and unrelated internal systems, indicating credential reuse

Detection Strategies

Enable database audit logging on the Streamsoft BI schema and alert on any read of the credential column outside of the application service account
Baseline the network peers that legitimately connect to the BI database port and flag connections from any other subnet
Correlate BI authentication logs with directory service logins to detect password reuse abuse after a suspected exposure

Monitoring Recommendations

Forward BI application, database, and host logs to a central SIEM with retention sufficient to investigate historical credential access
Monitor for schema changes to the users table around the 6.8.0.0 upgrade to confirm the column now stores hashed values
Track failed and successful logins per account and alert on impossible-travel or off-hours patterns tied to BI accounts

How to Mitigate CVE-2026-50641

Immediate Actions Required

Upgrade every Streamsoft BI instance to version 6.8.0.0 or later, which introduces hashed credential storage
Force a password reset for all BI users on next login, as recommended by the vendor, to invalidate any plaintext values still on disk or in backups
Rotate credentials on any external system where BI users may have reused their password
Restrict network access to the BI database so that only the application server can reach the listener port

Patch Information

Streamsoft addressed CVE-2026-50641 in Streamsoft BI 6.8.0.0. The release changes the credential storage format and requires each account to set a new password on first login, which replaces the legacy plaintext entry with a hashed value. Details are available in the CERT Poland advisory and the Streamsoft Business Intelligence product page.

Workarounds

If patching must be delayed, isolate the BI database on a dedicated network segment with strict firewall rules that permit only the BI application server
Encrypt database backups at rest and restrict access to backup storage to a minimal set of administrators
Revoke direct database access from analysts and reporting users; require all interaction to pass through the BI application layer
Enforce unique passwords for BI accounts through policy so that a future exposure does not compromise other systems

bash

# Configuration example: restrict database listener to the BI application host only
# (adjust interface, subnet, and firewall tooling for your environment)
iptables -A INPUT -p tcp --dport 1521 -s 10.20.30.40 -j ACCEPT
iptables -A INPUT -p tcp --dport 1521 -j DROP