CVE-2026-75338: disconf Auth Bypass Vulnerability

CVE-2026-75338 Overview

CVE-2026-75338 is an incorrect access control vulnerability in disconf (Distributed Configuration Management Platform) version 2.6.36. The LoginInterceptor component explicitly whitelists four configuration-fetching API endpoints, allowing anonymous attackers to read every configuration item and file managed by the config center. The exposed endpoints are /api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list. Any unauthenticated network attacker with reachability to the disconf service can enumerate and exfiltrate sensitive configuration data, including database credentials, API keys, and internal service settings stored in the platform.

Critical Impact
Anonymous attackers can read all configuration items and files managed by disconf 2.6.36, exposing credentials and secrets stored in the config center.

Affected Products

disconf (Distributed Configuration Management Platform) 2.6.36
Deployments exposing the disconf web interface on internal or external networks
Applications relying on disconf for centralized secret and configuration management

Discovery Timeline

2026-08-26 - CVE-2026-75338 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75338

Vulnerability Analysis

The vulnerability is a Broken Access Control flaw in disconf's request filtering layer. disconf routes incoming HTTP requests through a LoginInterceptor that is responsible for enforcing authentication on protected endpoints. Instead of denying anonymous access by default, the interceptor uses a whitelist that permits requests without session validation.

Four endpoints that serve configuration data are included in this whitelist. Attackers who can reach the disconf server over the network can invoke them directly and receive full configuration content. No credentials, tokens, or session cookies are required.

The impact is direct exposure of secrets. Configuration management platforms commonly store database connection strings, message broker credentials, third-party API keys, and internal service URLs. Disclosure of this data enables downstream compromise of the applications that depend on the config center.

Root Cause

The root cause is an authentication bypass introduced by the interceptor's whitelist logic. The LoginInterceptor treats /api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list as unauthenticated paths. These endpoints should require authenticated sessions because they return sensitive configuration payloads.

Attack Vector

Exploitation requires only HTTP access to the disconf service. An attacker issues GET requests to the whitelisted endpoints and parses the returned configuration items and files. The GitHub proof of concept published by researcher fangtang7 demonstrates direct retrieval of configuration data without authentication. See the Unauthenticated Exploit Analysis for endpoint-level request examples.

Detection Methods for CVE-2026-75338

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/config/item, /api/config/file, /api/config/list, or /api/config/simple/list on disconf hosts
Access to these endpoints from source IP addresses outside the expected administrator range
Sequential enumeration of application, environment, or version parameters against the config APIs

Detection Strategies

Review web server and reverse proxy access logs for requests to the four whitelisted config API paths and correlate with session cookies to identify anonymous callers
Alert on high-volume or scripted access patterns to /api/config/* endpoints from a single source
Deploy network signatures or WAF rules that inspect responses from disconf for known secret formats such as JDBC URLs and cloud provider access keys

Monitoring Recommendations

Forward disconf application logs and reverse proxy logs to a central analytics platform and retain them for at least 90 days
Baseline legitimate administrator access to config endpoints and alert on deviations, including new source IPs and off-hours access
Monitor egress traffic from the disconf host for unexpected outbound transfers that could indicate secret exfiltration

How to Mitigate CVE-2026-75338

Immediate Actions Required

Remove /api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list from the LoginInterceptor whitelist and require authenticated sessions for all config APIs
Restrict network access to the disconf management interface to trusted administrative subnets using firewall or ingress rules
Rotate all credentials, tokens, and keys stored in disconf that may have been exposed while the endpoints were reachable
Audit access logs for prior unauthenticated requests to the affected endpoints

Patch Information

No official vendor patch is referenced in the NVD entry for CVE-2026-75338 at the time of publication. Operators running disconf 2.6.36 should apply source-level modifications to the interceptor configuration or place the service behind an authenticating reverse proxy until an upstream fix is available. Consult the GitHub Unauthenticated Exploit Analysis for endpoint details when validating fixes.

Workarounds

Front the disconf service with a reverse proxy such as Nginx and enforce authentication or mutual TLS on the /api/config/* paths
Block the four affected endpoints at the WAF or ingress layer for any source outside the administrator network
Segment the disconf host into a management VLAN with strict allowlists for application clients that need to pull configuration

bash

# Nginx example: require authentication on disconf config APIs
location ~ ^/api/config/(item|file|list|simple/list)$ {
    auth_basic "disconf admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://disconf_backend;
}