CVE-2026-78386: RansomLook Information Disclosure Vulnerability

CVE-2026-78386 Overview

CVE-2026-78386 is an information disclosure vulnerability in RansomLook, an open-source tool that monitors ransomware group leak sites and dark web markets. The application returned location records verbatim through multiple unauthenticated API endpoints, exposing operator-side scraping configuration. Leaked fields included header values holding authentication headers and session cookies, init_script content containing CAPTCHA and paywall bypass logic, and browser engine details. An unauthenticated remote attacker could query the affected endpoints and retrieve credentials usable against monitored services, along with the internal logic that defeats their bot protections. The issue is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can extract stored credentials, session cookies, and anti-bot bypass logic from RansomLook, enabling credential replay against monitored ransomware sites and defeating the tool's collection capability.

Affected Products

RansomLook (open-source project) — versions prior to commit cc9182930306ff36c7b3424817d49f18df3c85d1
The generic API handler website/web/api/genericapi.py
Public location record endpoints returning non-private locations

Discovery Timeline

2026-08-24 - CVE-2026-78386 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78386

Vulnerability Analysis

RansomLook's generic API returned entire location documents to unauthenticated callers whenever a record was not explicitly marked as private. Location records mix public metadata with operator-side scraping configuration in the same document. Without a field-level filter, the API leaked every attribute, including credentials and bypass logic used to collect data from monitored sites.

The practical outcome is twofold. First, authentication material embedded in the header field, such as cookies or bearer tokens, can be replayed against the target site to impersonate the RansomLook operator. Second, the init_script and browser fields disclose how the scraper defeats anti-bot controls, allowing site operators or third parties to patch those defenses and blind the tool.

Root Cause

The root cause is missing output filtering on API responses. The affected handler serialized location dictionaries in full rather than projecting only fields intended for public consumption. Operator-side fields (header, init_script, browser) were stored alongside publishable fields (slug, fqdn, title, version) with no schema boundary between the two.

Attack Vector

An unauthenticated remote attacker sends HTTP requests to the affected generic API endpoints and iterates over public location identifiers. The response body contains the sensitive operator-side fields directly. No authentication, user interaction, or elevated privileges are required.

python

     return bool(_auth_helpers().viewer_is_authenticated(request))


+# Fields of a location record that may be published. Anything outside this set
+# is operator-side: `header` holds the cookies and authorization headers used to
+# scrape the site, `init_script` the logic that defeats its captcha or paywall,
+# `browser` the engine used. Publishing them lets the site operator replay the
+# credentials and patch the bypass.
+_PUBLIC_LOCATION_FIELDS = (
+    "slug",
+    "fqdn",
+    "title",
+    "version",
+    "available",
+    "updated",
+    "lastscrape",
+    "fs",
+    "chat",
+    "admin",
+    "screen",
+    "source",
+)
+
+
+def _public_location(location: dict[str, Any]) -> dict[str, Any]:
+    """Keep only the fields a location may expose to an untrusted caller."""
+    return {k: location[k] for k in _PUBLIC_LOCATION_FIELDS if k in location}
+
+
 def _source_path(relative: Any) -> str | None:

Source: RansomLook commit cc918293 — the patch adds _PUBLIC_LOCATION_FIELDS as an explicit allowlist and routes public responses through _public_location() to strip operator-side fields.

Detection Methods for CVE-2026-78386

Indicators of Compromise

Unauthenticated HTTP requests to RansomLook generic API endpoints returning JSON bodies that contain header, init_script, or browser keys.
Outbound requests from unexpected IP addresses using session cookies or authorization headers originally provisioned for the RansomLook scraper.
Sudden failures of scraping jobs against monitored ransomware leak sites, indicating a target has adapted after bypass logic disclosure.

Detection Strategies

Review web server access logs for high-volume enumeration of location or post identifiers from a single source IP.
Inspect API response payloads at an egress proxy or WAF for the presence of operator-side field names in outbound responses.
Correlate authentication anomalies on monitored sites with historical scraper credentials to identify replay activity.

Monitoring Recommendations

Alert on non-2xx and 2xx responses from RansomLook API paths containing the strings init_script or header in the response body.
Track the age and last-used timestamp of any credentials stored in the RansomLook configuration and rotate on any anomaly.
Monitor commit and deployment status of RansomLook instances to confirm operators are running the patched revision.

How to Mitigate CVE-2026-78386

Immediate Actions Required

Update RansomLook to a revision that includes commit cc9182930306ff36c7b3424817d49f18df3c85d1 or later.
Rotate all credentials, cookies, and API tokens previously stored in location header fields, as they must be considered exposed.
Restrict public exposure of the RansomLook web interface to trusted networks until the patch is applied and verified.
Audit historical API access logs to identify potential prior extraction of operator-side configuration.

Patch Information

The upstream fix is available in the RansomLook repository as commit cc9182930306ff36c7b3424817d49f18df3c85d1. The patch introduces _PUBLIC_LOCATION_FIELDS in website/web/api/genericapi.py and applies _public_location() to strip all operator-side fields from unauthenticated responses. A separate route change from <string:postname> to <path:postname> is a functional correction for post titles containing forward slashes and is unrelated to the security issue.

Workarounds

Mark all location records as private until the patched version is deployed, forcing authentication for retrieval.
Place the RansomLook instance behind an authenticating reverse proxy that blocks unauthenticated requests to /api/ paths.
Remove or blank operator-side fields (header, init_script, browser) from stored location documents if they are not required for active scraping.

bash

# Update to the patched RansomLook revision
cd /opt/RansomLook
git fetch origin
git checkout cc9182930306ff36c7b3424817d49f18df3c85d1
# Restart the service to load the patched API handler
systemctl restart ransomlook.service