CVE-2026-50870: Whoogle Search Information Disclosure

CVE-2026-50870 Overview

CVE-2026-50870 is an information disclosure vulnerability in Ben Busby's whoogle-search version 1.2.3. The flaw resides in the application's configuration endpoint, which exposes sensitive data to unauthenticated attackers. A remote attacker can issue a crafted HTTP GET request to retrieve configuration information that should remain private. Whoogle-search is a self-hosted, privacy-focused metasearch proxy, so leakage of configuration data directly undermines its security model. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive whoogle-search configuration data over the network with no user interaction, exposing operational details of self-hosted instances.

Affected Products

Ben Busby whoogle-search v1.2.3
Self-hosted whoogle-search deployments exposing the configuration endpoint
Containerized whoogle-search instances based on the affected release

Discovery Timeline

2026-06-15 - CVE-2026-50870 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50870

Vulnerability Analysis

The vulnerability exists in the configuration endpoint of whoogle-search v1.2.3. The endpoint returns configuration data in response to a standard HTTP GET request without enforcing authentication or authorization controls. An attacker with network reachability to the application can query the endpoint directly and receive sensitive operational details. The exposed information may include search backend settings, proxy configuration, and other internal parameters that operators expect to remain private. Because whoogle-search is designed as a privacy-preserving search frontend, configuration leakage can reveal deployment topology and integration secrets that aid further attacks. The issue is tracked under CWE-200, covering exposure of sensitive information to an unauthorized actor.

Root Cause

The root cause is missing access control on the configuration endpoint. The application serves configuration data to any caller that reaches the route, with no session check, token validation, or origin restriction. Configuration handlers in web applications should require an authenticated administrative session before returning settings. Whoogle-search v1.2.3 omits this check, treating the configuration view as a public route.

Attack Vector

Exploitation requires only network access to the whoogle-search instance. An attacker sends a crafted GET request to the configuration endpoint and parses the response for sensitive values. No credentials, prior compromise, or user interaction are required. Internet-exposed self-hosted deployments are most at risk, but instances reachable from internal networks are also affected. A proof-of-concept demonstrating the request pattern is published as a GitHub Gist PoC.

No verified exploit code is reproduced here. See the linked PoC for technical details of the request structure and the fields returned by the vulnerable endpoint.

Detection Methods for CVE-2026-50870

Indicators of Compromise

Unexpected HTTP GET requests targeting the whoogle-search configuration route from external or unauthorized internal source addresses.
Web server access logs showing successful 200 OK responses to configuration endpoint requests issued without an authenticated session.
Outbound reconnaissance scans hitting whoogle-search hosts followed by direct requests to administrative paths.

Detection Strategies

Review reverse proxy and application logs for requests to the configuration endpoint and baseline the expected administrative sources.
Deploy web application firewall (WAF) rules to alert on configuration endpoint access from non-allowlisted IP ranges.
Correlate access log anomalies with network telemetry to identify reconnaissance activity preceding endpoint queries.

Monitoring Recommendations

Forward whoogle-search access logs to a centralized logging or SIEM platform for retention and correlation.
Alert on any unauthenticated GET request returning configuration content, especially from public IP ranges.
Monitor for spikes in 4xx/5xx responses on adjacent administrative paths that may indicate enumeration attempts.

How to Mitigate CVE-2026-50870

Immediate Actions Required

Restrict network exposure of whoogle-search instances by placing them behind a VPN, reverse proxy with authentication, or IP allowlist.
Block external access to the configuration endpoint at the reverse proxy or WAF until an upstream fix is applied.
Rotate any credentials, API keys, or proxy secrets that may have been present in the configuration of exposed instances.

Patch Information

No vendor patch information is available in the NVD record for CVE-2026-50870 at the time of publication. Operators should monitor the whoogle-search GitHub repository for an updated release that addresses the configuration endpoint exposure and upgrade as soon as a fixed version is available.

Workarounds

Front whoogle-search with an authenticating reverse proxy (for example, nginx with HTTP basic auth or an OAuth proxy) that blocks unauthenticated access to administrative routes.
Bind the whoogle-search service to localhost or an internal interface and expose only the public search routes through a hardened gateway.
Apply firewall rules to limit inbound traffic to the application to known administrator source addresses.

bash

# Configuration example: nginx reverse proxy blocking the configuration endpoint
location /config {
    allow 10.0.0.0/8;        # internal admin range
    deny all;
    proxy_pass http://127.0.0.1:5000;
}

location / {
    proxy_pass http://127.0.0.1:5000;
}