CVE-2026-78555: RansomLook Information Disclosure Vulnerability

CVE-2026-78555 Overview

CVE-2026-78555 is an information disclosure vulnerability in RansomLook, an open-source ransomware tracking platform. The authenticated /admin/apikeys administration page rendered complete API keys inside hidden HTML form fields, even though the visible interface displayed only truncated representations. Any administrator viewing the page, along with any intermediary that captured the response body, could recover the full tokens. An attacker who obtained a token could authenticate to the API with that key's assigned privileges, including access to entries flagged as private. The weakness is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Full API keys were embedded in hidden form fields on the admin page, enabling credential recovery through the DOM, debugging proxies, browser caches, or monitoring systems.

Affected Products

RansomLook (open-source ransomware intelligence platform)
The /admin/apikeys administrative interface
Pre-patch revisions of website/web/templates/admin/apikeys.html

Discovery Timeline

2026-08-24 - CVE-2026-78555 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78555

Vulnerability Analysis

The RansomLook administration interface displays a list of issued API keys with truncated identifiers. The visible truncation created the impression that the full secret was not present in the response. In practice, the Jinja template rendered the complete token into hidden <input> elements used by the enable/disable, private-access toggle, and delete forms. Any client rendering the page received every active API key in cleartext HTML.

Recovering the tokens required no exploitation primitive beyond reading the DOM or the raw HTTP response. Debugging proxies, browser developer tools, browser caches, and upstream monitoring or logging systems that inspect response bodies could all retain the disclosed credentials. A token holder could then call the RansomLook API with the permissions bound to that key, including read access to private entries where such access had been granted.

Root Cause

The template embedded raw k.token values as hidden form parameters so that administrative POST actions could identify the target key. The server trusted the returned token directly. The design coupled the identifier used by the UI with the secret used to authenticate to the API, violating the principle that secrets should be disclosed once at creation.

Attack Vector

Attack requires the response body of /admin/apikeys to reach an unauthorized viewer. Realistic paths include shoulder-surfing, shared administrator sessions, cached responses on shared hosts, intercepting proxies with response logging, browser extensions with DOM access, and centralized monitoring systems that store HTTP payloads. Privileges of the recovered key determine subsequent impact.

python

# Security patch in website/web/__init__.py
# Adds hmac for constant-time handle comparison
 import datetime
 import glob
 import hashlib
+import hmac
 import imghdr
 import json
 import mimetypes

Source: RansomLook commit b358dfa

text

<!-- Security patch in website/web/templates/admin/apikeys.html -->
<!-- Hidden inputs now carry a SHA-256-derived handle, not the token -->
 <form action="{{ url_for('admin_apikeys_toggle') }}" method="post" style="margin:0;">
-  <input type="hidden" name="token"  value="{{ k.token }}">
+  <input type="hidden" name="handle" value="{{ k.handle }}">
   <button class="btn btn-secondary btn-sm" type="submit">
     {{ _('Disable') if k.active else _('Enable') }}
   </button>
 </form>
 <form action="{{ url_for('admin_apikeys_toggle_private') }}" method="post" style="margin:0;">
-  <input type="hidden" name="token"  value="{{ k.token }}">
+  <input type="hidden" name="handle" value="{{ k.handle }}">
 </form>
 <form action="{{ url_for('admin_apikeys_delete') }}" method="post" style="margin:0;">
-  <input type="hidden" name="token"  value="{{ k.token }}">
+  <input type="hidden" name="handle" value="{{ k.handle }}">
 </form>

Source: RansomLook commit b358dfa

Detection Methods for CVE-2026-78555

Indicators of Compromise

HTTP responses from /admin/apikeys containing <input type="hidden" name="token" fields with values longer than the truncated display length.
API authentication events from IP addresses or user agents that have never previously used a given key.
Requests to private-flagged entries using keys that historically only accessed public data.

Detection Strategies

Review web server access logs for requests to /admin/apikeys and correlate against known administrator sessions and source addresses.
Search proxy, WAF, and monitoring tools for stored response bodies that contain the pre-patch template markup.
Diff deployed template files against the patched revision to confirm whether the vulnerable k.token hidden inputs are still rendered.

Monitoring Recommendations

Alert on any API key usage patterns that deviate from baseline source IPs, request rates, or endpoint sets.
Log key rotation events and cross-reference against administrator activity on /admin/apikeys.
Audit any intermediary system that stores HTTP response bodies and purge cached copies of admin pages.

How to Mitigate CVE-2026-78555

Immediate Actions Required

Update RansomLook to a revision that includes commit b358dfa4f40c677a47c602ebbb4473aeae349f5c or later.
Rotate every API key that existed before the upgrade, since prior page renders may have leaked them.
Purge cached copies of /admin/apikeys from browser caches, proxies, and log or SIEM systems that retain response bodies.
Restrict administrative access to /admin/apikeys to trusted networks and enforce short-lived administrator sessions.

Patch Information

The upstream fix removes API keys from subsequent page renders and substitutes SHA-256-derived opaque handles. Administrative form submissions transmit only the handle, which the server resolves back to the token using constant-time comparison via hmac. The full API key is disclosed exactly once, at creation. Deploy the changes to website/web/__init__.py and website/web/templates/admin/apikeys.html as shown in RansomLook commit b358dfa.

Workarounds

If patching is not immediately possible, disable the /admin/apikeys route at the reverse proxy and manage keys directly in the backing store.
Revoke and reissue all API keys, then treat any prior key material as compromised.
Block response-body logging for administrative paths at intermediary proxies and monitoring agents.

bash

# Apply the upstream fix and rotate all existing API keys
cd /opt/RansomLook
git fetch origin
git checkout b358dfa4f40c677a47c602ebbb4473aeae349f5c
systemctl restart ransomlook

# After restart, log in and rotate every existing key
# (delete and reissue from the admin UI or database)