CVE-2026-50110: Use of Hard-coded Credentials in StoneFly Storage Concentrator

Synopsis

Use of hard-coded credentials in StoneFly Storage Concentrator (SC and SCVM) allows an attacker who can read the embedded configuration file to recover plaintext credentials for a wide range of internal services. The CVSS vector indicates local access is required with no authentication or user interaction needed, meaning an attacker already on the host can extract and decode the credentials without any privilege barrier. Successful exploitation grants unauthorized access to database accounts, licensing services, replication services, and third-party integrations, enabling both data theft and tampering across interconnected systems. Patched-image rebuilds at versions 8.0.4.26 and 8.0.4.29 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attack vector is local (AV:L), so the attacker needs an existing shell or process on the host to read the configuration file.

• AuthenticationNot required

  No privileges are required (PR:N), meaning any process or user that can access the filesystem can retrieve the encoded credentials without authenticating first.

• Victim interactionNot required

  No user interaction is required (UI:N); the attacker can extract and decode the credentials entirely on their own.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is straightforward and condition-free once local access is established.

Blast Radius

• Reads plaintext database credentials recovered from the configuration file, exposing stored records across all connected database accounts.
• Modifies or corrupts replicated data by leveraging recovered replication-service credentials across interconnected storage nodes.
• Accesses third-party integration accounts and licensing services using the extracted credentials, extending the breach beyond the local host.
• Causes limited disruption to the storage service itself (VA:L), but achieves high-impact compromise of both the local system and connected upstream systems (SC:H, SI:H).