Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-102628 is a critical-severity Insertion of Sensitive Information Into Debugging Code (CWE-215) vulnerability in Githubusercontent (inferred from references). Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-2 (Baseline Configuration) and CM-7 (Least Functionality) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-91033
Vulnerability Data
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment,…
more
including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.4.2
Mitigating Controls (NIST 800-53 r5) AI
Baseline configuration defines the approved production state that must exclude active debug code.
Least functionality directly prohibits enabling unnecessary debug features that would expose the inserted sensitive data.
Developer testing and evaluation will discover debug code containing sensitive information before release.
Requiring documented secure development processes and standards stops insertion of sensitive data into debug paths.
Security-integrated SDLC processes ensure debug artifacts are stripped prior to deployment.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicitly calls for removing confidential data from processes, logs, and memory dumps that debug code commonly exposes.
Hardened configuration baselines and deployment checks can ensure debug features and associated data are disabled in production.
Secure SDLC practices directly prevent developers from embedding sensitive information inside debugging statements or code paths.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure SDLC mandates removal of debug code and sensitive data before release.
Secure coding standards explicitly prohibit embedding secrets or debug statements.
Security testing in development catches debug statements and sensitive data leaks.
A.8.31 separates environments and restricts what reaches production; it does not stop sensitive information from being inserted into debugging code in the first place, so the weakness can still be present and exploitable if debugging code slips into production.