CVE-2026-108754 — GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAu…
Published: 2026-10-11 · CVSS: 4.8 · CVSS 4.0
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7