CVE-2026-50870: An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1

Synopsis

This is an information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3. The flaw is reachable over the network with no authentication required, and an attacker can exploit it by sending a crafted GET request to the affected endpoint. Successful exploitation gives the attacker access to sensitive configuration information. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable configuration endpoint is exposed over the network, so the attacker must be able to reach it via a standard HTTP request from a remote host.

• AuthenticationNot required

  No credentials or session token are needed; the crafted GET request can be sent by any unauthenticated caller.

• Victim interactionNot required

  The attacker sends a direct request to the endpoint and does not need any action from a user or operator of the affected service.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is straightforward and reliable with no race conditions or special environmental preconditions required.

Blast Radius

• A successful attacker reads sensitive configuration data exposed by the whoogle-search configuration endpoint, which may include internal settings, API keys, proxy credentials, or other deployment parameters stored there.
• Exposed configuration values can be used to pivot further, for example by reusing credentials or understanding internal network topology revealed in the config.
• Confidentiality of the affected service is fully compromised; integrity and availability of the service are not directly affected by this vulnerability.