Skip to content
Heist/ feed
Back to feed
Medium

GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger

Type: advisorySources: OSV

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-108754
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 02:25 UTC · Revision 1

Source evidence

GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger

core-osv · Original source

Published 11 Oct 2026, 12:19 UTC

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.

osv:CVE-2026-108754
Complete source record
{
  "id": "be3a07708c2d5ebe50cb677e93f2c692980b5a5cd701c88b9025ea1245750446",
  "url": "https://osv.dev/vulnerability/CVE-2026-108754",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger",
    "summary": "GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.",
    "evidence": "osv:CVE-2026-108754",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-108754",
      "aliases": [
        "CVE-2026-108754"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/tbphp/gpt-load",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "a12882be9e06011da5e0284db5dd4617a7ca6e6d"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.4.11"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.4.11"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.4.11",
            "v1.4.10",
            "v1.4.9",
            "v1.4.8",
            "v1.4.7",
            "v1.4.6",
            "v1.4.5",
            "v1.4.4",
            "v1.4.3",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0-beta.2",
            "v1.4.0",
            "v1.4.0-beta.1",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.3.0-beta.6",
            "v1.3.0-beta.5",
            "v1.3.0-beta.4",
            "v1.3.0-beta.3",
            "v1.3.0-beta.2",
            "v1.3.0-beta.1",
            "v1.2.1",
            "v1.2.0",
            "v1.1.0",
            "v1.0.22",
            "v1.0.21",
            "v1.0.20",
            "v1.0.19",
            "v1.0.18",
            "v1.0.17",
            "v1.0.16",
            "v1.0.15",
            "v1.0.14",
            "v1.0.13",
            "v1.0.12",
            "v1.0.11",
            "v1.0.9-beta",
            "v1.0.10",
            "v1.0.8-beta",
            "v1.0.7-beta",
            "v1.0.6-beta",
            "v1.0.5-beta",
            "v1.0.4-beta",
            "v1.0.3-beta",
            "v1.0.2-beta",
            "v1.0.1-beta",
            "v1.0.0-beta",
            "v0.1.4",
            "v0.1.3",
            "v0.1.2",
            "v0.1.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108754.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.443090632Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108754.json",
        "https://hackmd.io/@haind03/tbphp-gpt-load-proxy-key-access-log-disclosure",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-108754",
        "https://www.vulncheck.com/advisories/gpt-load-through-1.4.11-cleartext-proxy-key-logging-via-access-logger",
        "https://github.com/tbphp/gpt-load",
        "https://github.com/tbphp/gpt-load/blob/a12882be9e06011da5e0284db5dd4617a7ca6e6d/internal/middleware/middleware.go#L20-L74",
        "https://github.com/tbphp/gpt-load/blob/a12882be9e06011da5e0284db5dd4617a7ca6e6d/internal/middleware/middleware.go#L247-L254"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-532"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108754.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-108754",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499677,
  "published_at": "2026-10-11T12:19:53.343+00:00"
}