CVE-2026-96550: hosp_order Cleartext Transmission Vulnerability

CVE-2026-96550 Overview

CVE-2026-96550 affects the sfturing/hosp_order project, an open-source hospital order management application distributed via GitHub. The flaw resides in the getProperties function of ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java. The function transmits sensitive mail configuration data in cleartext, allowing a remote attacker positioned on the network path to intercept credentials or configuration values. The weakness is classified under [CWE-310] (Cryptographic Issues). The project uses continuous delivery with rolling releases, so no discrete affected or fixed versions are enumerated. A public exploit reference is available, though exploitation complexity is rated high.

Critical Impact
Remote adversaries with network observation capability can capture cleartext mail configuration data handled by the MailUtil component.

Affected Products

sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8
File ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java
Function getProperties

Discovery Timeline

2026-09-23 - CVE-2026-96550 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96550

Vulnerability Analysis

The getProperties function inside MailUtil.java handles mail server configuration and credential loading for the hosp_order application. The routine transmits or exchanges these values over an unencrypted channel, exposing them to any adversary able to observe network traffic between the application and its mail infrastructure. Because the affected data includes mail server credentials, exposure can enable follow-on account abuse against the mail service. The upstream project has been notified through a GitHub issue but has not responded, and rolling-release delivery means no patched release identifier is available.

Root Cause

The root cause is the absence of transport-layer encryption when handling sensitive properties in MailUtil.getProperties. Rather than negotiating TLS (Transport Layer Security) or STARTTLS for the mail session, the implementation exchanges configuration and authentication data over plaintext. The defect maps to [CWE-310] Cryptographic Issues, specifically the cleartext transmission of sensitive information.

Attack Vector

Exploitation requires an attacker to occupy a privileged network position between the vulnerable application and the mail server. Once positioned, the attacker passively captures traffic and extracts credentials or configuration content. The attack is remote and requires no authentication, but the attack complexity is high because the adversary must establish suitable interception before the application invokes getProperties.

No verified proof-of-concept code is published in this dataset. Refer to the GitHub Issue Tracker and the VulDB Vulnerability Report for technical background.

Detection Methods for CVE-2026-96550

Indicators of Compromise

Unencrypted SMTP (Simple Mail Transfer Protocol) sessions originating from application servers running hosp_order.
Mail server authentication attempts from unexpected source addresses reusing credentials configured in MailUtil.java.
Presence of the vulnerable commit 627f426331da8086ce8fff2017d65b1ddef384f8 or earlier in deployed repositories.

Detection Strategies

Perform static code review of ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java to confirm whether mail.smtp.starttls.enable or equivalent TLS properties are set.
Use network sensors to flag outbound SMTP connections on port 25 or 587 that do not negotiate STARTTLS.
Correlate mail credential use in logs against expected application source hosts.

Monitoring Recommendations

Continuously monitor east-west and egress traffic from application tiers for cleartext SMTP, IMAP (Internet Message Access Protocol), or POP3 (Post Office Protocol 3) sessions.
Track mail account sign-ins for geographic and behavioral anomalies, including impossible-travel patterns.
Alert on new deployments of hosp_order that reintroduce the vulnerable getProperties code path.

How to Mitigate CVE-2026-96550

Immediate Actions Required

Reconfigure MailUtil to enforce TLS or STARTTLS on all outbound mail sessions and disable plaintext fallback.
Rotate any mail account credentials that were configured in the vulnerable getProperties routine.
Restrict application-to-mail-server traffic to authenticated, encrypted channels using network policy.

Patch Information

The project uses continuous delivery with rolling releases, and no fixed commit or version has been published. A tracking issue was filed at the GitHub Issue Tracker, but the maintainer has not responded. Consult the VulDB CVE Analysis for status updates and monitor the GitHub PoC Repository for future commits addressing MailUtil.java.

Workarounds

Apply a local patch to MailUtil.getProperties that sets mail.smtp.starttls.required=true and validates the server certificate chain.
Route mail traffic through an internal relay that enforces TLS before forwarding to external providers.
Segment the application host so only trusted networks can observe mail flows, reducing the interception window.

bash

# Configuration example: enforce STARTTLS in JavaMail properties
mail.smtp.host=smtp.example.org
mail.smtp.port=587
mail.smtp.auth=true
mail.smtp.starttls.enable=true
mail.smtp.starttls.required=true
mail.smtp.ssl.trust=smtp.example.org