CVE-2026-104384

{
  "etk_id": "ETK-2026-2831",
  "cve_id": "CVE-2026-104384",
  "display_id": "CVE-2026-104384",
  "ghsa_id": "GHSA-wm5p-g46q-pcjq",
  "euvd_id": "EUVD-2026-111588",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Credential protection flaw in EagleCloud Aquila interfaces",
  "summary": "EagleCloud Aquila on-premises deployments through 2.6.7.2 have insufficient credential protection in tunnel gateway and provisioning interfaces. An unauthenticated remote attacker able to reach these interfaces may obtain elevated access and expose access keys, secret keys, or deployment secrets.",
  "mitigation": "Restrict network access to Aquila tunnel gateway and provisioning interfaces to trusted administrative networks and accounts. No fixed version is recorded; apply vendor-provided updates or guidance when available.",
  "vendor": "EagleCloud",
  "product": "Aquila",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.6.7.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Aquila",
      "purl": null
    }
  ],
  "cwes": [
    522
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 17.900620316666668,
  "t0_at": "2026-10-28T04:21:29.717000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-28T04:21:29.717000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T04:21:29.717000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104384"
    }
  }
}