CVE-2026-107177
Raw vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-107177 is a high-severity Use of Default Cryptographic Key (CWE-1394) vulnerability. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-94317
Vulnerability Data
Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them…
more
with stored token IDs to obtain valid bearer tokens for any user.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requiring the most restrictive configuration settings prohibits the use of known default cryptographic keys.
Cryptographic key establishment and management requires generating and provisioning unique keys rather than relying on manufacturer defaults.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential/key management practices eliminate default cryptographic keys for identities and services.
Strong authentication requirements implicitly disallow default keys but do not address key management itself.
Configuration management directly prohibits default keys via hardened baselines and change control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.19 governs the process, authorization, testing and approval of software installation/updates on operational systems but contains no requirement to replace, avoid or configure away a default cryptographic key that is already present in the installed software.
A.8.24 requires determining and applying appropriate cryptography per policy and classification; it does not stop a default key from being present or from being exploitable when one is used
Change-management processes should detect and remediate default cryptographic keys.