CVE-2026-102527
Description
A flaw was found in nuxt-og-image. An unauthenticated remote attacker can cause content spoofing by poisoning the application's image cache. Because dynamic image routes accept unsigned requests and generate predictable cache keys, an attacker can submit crafted parameters to overwrite legitimate Open Graph (OG) image entries, resulting in spoofed visual content being served to users.
Statement
Red Hat has rated this vulnerability as Moderate because, although it can be triggered remotely without authentication, the blast radius is strictly confined to visual content spoofing without impacting system confidentiality, availability, or host integrity. Predictable indexing allows hostile requests to overwrite cached metadata previews, yet attackers cannot execute arbitrary code or exfiltrate private assets. Furthermore, the affected module is not provided or integrated within Red Hat enterprise software, limiting exposure in default product environments.
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
