CVE-2026-91198: GrowthBook Information Disclosure Flaw

CVE-2026-91198 Overview

CVE-2026-91198 is an information disclosure vulnerability in GrowthBook through version 5.0.1. The application returns unredacted fact table definitions, including raw data warehouse SQL, in payloads served by unauthenticated public report and experiment endpoints. Attackers who know or guess a publicly shared report or experiment identifier can read internal warehouse query text, schema, table names, filter values, and datasource identifiers. The flaw is tracked under CWE-201: Insertion of Sensitive Information Into Sent Data and requires no authentication or user interaction to exploit over the network.

Critical Impact
Unauthenticated remote attackers can retrieve internal data warehouse SQL, schema details, and datasource identifiers from GrowthBook deployments serving public reports or experiments.

Affected Products

GrowthBook through version 5.0.1
GrowthBook back-end public report endpoints
GrowthBook back-end public experiment endpoints

Discovery Timeline

2026-09-14 - CVE-2026-91198 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91198

Vulnerability Analysis

GrowthBook exposes public, unauthenticated endpoints so teams can share experiment results and reports outside the authenticated console. These endpoints serialize full internal objects, including fact table definitions that embed the underlying warehouse SQL and datasource metadata. The server does not redact sensitive fields before returning the response.

An attacker with a valid report or experiment identifier can request the public endpoint and parse the JSON payload. The response reveals query text executed against the customer's data warehouse, along with schema names, table names, filter values, and datasource identifiers. This exposure is limited to confidentiality; integrity and availability of the GrowthBook instance are not directly affected.

Report and experiment identifiers are frequently shared via email, chat, and public dashboards, which increases the likelihood that identifiers become discoverable. The vulnerability is exploitable remotely over the network with low attack complexity and no privileges.

Root Cause

The root cause is missing output filtering in the public endpoint handlers. Internal fact table objects that contain warehouse SQL are serialized into responses intended for anonymous consumers. See the referenced back-end code in app.ts and reports.ts for the affected paths, and GrowthBook Issue #6541 for maintainer discussion.

Attack Vector

Exploitation requires knowledge of a public report or experiment identifier. The attacker issues an HTTP GET request to the public report or experiment endpoint on a GrowthBook instance. The server responds with a JSON body containing the fact table definitions, including raw warehouse SQL, schema, table names, filter values, and datasource identifiers. No authentication, session, or interaction with a legitimate user is required. For a full write-up, see the VulnCheck Advisory for GrowthBook.

Detection Methods for CVE-2026-91198

Indicators of Compromise

Unexpected HTTP GET requests to public report or experiment endpoints from unknown IP addresses or automated user agents.
Response bodies from public endpoints containing sql, factTable, datasource, or schema keys returned to unauthenticated clients.
Enumeration patterns where a single client requests many sequential or randomized report or experiment identifiers.

Detection Strategies

Inspect GrowthBook access logs for high-volume requests to the public report and experiment routes documented in app.ts.
Deploy a reverse proxy or web application firewall rule that flags public endpoint responses containing warehouse SQL keywords such as SELECT, FROM, or JOIN.
Correlate identifier scans against the list of report and experiment identifiers considered internal-only.

Monitoring Recommendations

Enable request and response logging on the GrowthBook back-end and forward logs to a centralized analytics platform for retention and querying.
Alert on any anonymous request that returns a payload above a normal size threshold from public report and experiment routes.
Track outbound queries executed against the data warehouse to identify unexpected reuse of leaked SQL by third parties.

How to Mitigate CVE-2026-91198

Immediate Actions Required

Inventory GrowthBook deployments and identify any instance running version 5.0.1 or earlier that exposes public reports or experiments.
Restrict network access to the public report and experiment endpoints until a fixed release is deployed.
Rotate any warehouse credentials or datasource secrets that may have been referenced in exposed SQL or metadata.

Patch Information

No fixed version was listed in the NVD entry at the time of publication. Monitor the GrowthBook GitHub Repository and GrowthBook Issue #6541 for the official patch release, then upgrade to the fixed version as soon as it is available.

Workarounds

Disable public sharing of reports and experiments in the GrowthBook configuration until the patched release is deployed.
Place the GrowthBook back-end behind an authenticating reverse proxy or IP allowlist to block anonymous access to public endpoints.
Apply a proxy-level response filter that strips factTable and sql fields from JSON payloads served by the public report and experiment routes.

bash

# Example nginx snippet to block anonymous access to public GrowthBook endpoints
location ~ ^/api/(report|experiment)/public/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://growthbook_backend;
}