CVE-2026-113799
Description
A flaw was found in slack-morphism. When signature verification fails for an incoming request, the library calculates the expected Hash-based Message Authentication Code (HMAC) signature and records it in error logs. An attacker with network access to the Slack callback endpoint and read access to application logs can retrieve this valid signature. By resubmitting the request with the captured signature within the validity window, the attacker can bypass signature verification and deliver forged requests to protected application callbacks without possessing the signing secret.
Statement
This vulnerability is rated as Moderate because successful exploitation requires multiple compounding prerequisites, including network reachability to the endpoint and existing read privileges over application error logs. Although an attacker possessing log access could replay the leaked cryptographic token within a short time window to execute forged actions, slack-morphism is not included in core Red Hat product distributions. Consequently, typical Red Hat enterprise environments remain unaffected unless custom application stacks build upon this third-party Rust crate.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Often this will either reveal sensitive information which may be used to launch another, more focused attack or disclose private information stored in the server. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
