CVE-2026-67598

EIP tracks 1 public exploit for CVE-2026-67598. PoCs published by IlhomjonR.

AI-analyzed exploit summary Detailed technical analysis of CVE-2026-67598, a vulnerability in Emlog v2.6.23's AI assistant feature. The report identifies two issues: disabled TLS verification for outbound AI HTTP calls (CWE-295) and insufficient protection of the `user` table in AI-driven SQL tool calls, enabling indirect prompt injection for account takeover.

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query_database and update_config tool handlers.