CVE-2026-122154
Description
A flaw was found in Yank Note. The application's settings endpoint improperly includes sensitive keys in server configuration responses. A remote attacker can exploit this vulnerability by querying the configuration endpoint to obtain sensitive configuration data, leading to information disclosure.
Statement
This vulnerability is evaluated with a Moderate impact because an unauthenticated network actor can retrieve sensitive server configuration parameters, but the flaw does not facilitate system compromise or integrity tampering. Additionally, Yank Note is not distributed or supported within Red Hat Enterprise Linux or related enterprise offerings, resulting in no direct exposure for standard Red Hat environments.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
