CVE-2026-105292 chaterm CVE debrief

Who should care

Defenders responsible for Chaterm installations should assess exposure and apply patches or mitigations as available. Defenders should prioritize verifying exposure of Chaterm installations to this vulnerability and apply patches or mitigations as available. The vulnerability can be triggered by a crafted callback with attacker-controlled userInfo from a web page, signing the victim into the attacker's account so default data sync uploads saved hosts, and

Why it matters

CVE-2026-105292 is a medium-severity login cross-site request forgery vulnerability in Chaterm before version 0.12.1, allowing remote attackers to inject login state and potentially leading to unauthorized access and data exposure. Defenders should prioritize verifying exposure and applying patches or mitigations.

• Potential unauthorized access to Chaterm accounts
• Possible data exposure through saved hosts, passwords, and private keys
• Need to verify Chaterm installations for exposure
• Priority on applying patches or mitigations

Technical summary

The vulnerability allows remote attackers to inject login state by sending crafted chaterm:// callbacks without OAuth state validation, potentially leading to unauthorized access and data exposure. The vulnerability can be triggered by a crafted callback with attacker-controlled userInfo from a web page, signing the victim into the attacker's account so default data sync uploads saved hosts, passwords, and private keys. Chaterm versions before 0.12.1 are affected, and the fix is available in version 0.12.1. Defenders should prioritize verifying exposure of Chaterm installations to this vulnerability and apply patches or mitigations as available. The CVE record and NVD entry provide additional information on the

Defensive priority

Defenders should prioritize verifying exposure of Chaterm installations to this vulnerability and apply patches or mitigations as available.

Recommended defensive actions

• Verify Chaterm installations for exposure to this vulnerability
• Apply patches or mitigations as available
• Monitor for suspicious login activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD entry. Chaterm versions before 0.12.1 are affected. The fix is available in version 0.12.1. The vulnerability allows remote attackers to inject login state by sending crafted chaterm:// callbacks without OAuth state validation, potentially leading to unauthorized access and data exposure. Defenders should verify exposure and apply patches or mitigations as available. The CVE record was published on 2026-10-05T01:16:28.630Z and has not been modified since then. The NVD entry and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.