CVE-2026-11347: Hardcoded Cryptographic Keys and Weak IV Generation in Linqi Application

Synopsis

Hardcoded cryptographic keys and weak IV generation affect the linqi application (versions up to and including 1.4.8.5). A local attacker with a low-privilege account can exploit predictable AES/CBC initialization vectors and embedded keys to perform known-plaintext attacks against encrypted configuration data. Successful exploitation gives the attacker access to database credentials stored in appsettings.json. HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to reach the vulnerable code paths.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative rights to read configuration files or invoke the vulnerable decryption logic.

• Victim interactionNot required

  No user interaction is required; the attacker operates entirely on their own without needing to social-engineer another party.

• Attack complexityDetail

  The exploit is reliable and condition-free: the hardcoded keys are static and the limited ASCII charset used for IV generation makes exhaustive recovery straightforward without depending on race conditions or memory layout.

Blast Radius

• Reads AES-encrypted configuration strings from appsettings.json, recovering plaintext database ConnectionString values including hostnames, usernames, and passwords.
• Gains direct database credentials, enabling further authentication to backend data stores with whatever permissions the connection string user holds.
• Any data accessible to the compromised database account, including stored records, session data, and application secrets, is exposed to the attacker.