CVE-2026-39908: OpenBullet2 0.3.2 NTLMv2 Hash Disclosure via UNC Path Proxy Source

Synopsis

This is a credential disclosure vulnerability in OpenBullet2 version 0.3.2 and earlier on Windows. An attacker with a low-privilege account can configure a job proxy source to point at a UNC path on an attacker-controlled server; when the job runs, the application triggers an SMB authentication attempt that leaks the NTLMv2 hash of the process user. The captured hash can be cracked offline or relayed to authenticate against other services in the environment. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the OpenBullet2 instance over the network to configure the malicious proxy source, as the attack vector is network-based (AV:N).

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must be authenticated to the application to configure job proxy sources (PR:L).

• Victim interactionNot required

  No victim interaction is needed; once the malicious proxy source is saved, the next job start triggers the SMB authentication attempt automatically (UI:N).

• Attack complexityDetail

  Exploit conditions are straightforward and reliable with no race conditions or special environmental dependencies required (AC:L).

Blast Radius

• The NTLMv2 hash of the OS user account running the OpenBullet2 process is exposed to the attacker-controlled server.
• An attacker can attempt to crack the captured hash offline to recover the plaintext password of that Windows account.
• The hash can be relayed using standard NTLM relay techniques to authenticate against other Windows services in the same network, such as SMB shares or internal web applications.
• Confidentiality of the process user credential is fully compromised (VC:H); integrity and availability of the host are not directly affected by this specific vector.