CVE-2026-75338 disconf CVE debrief

Who should care

Defenders responsible for disconf 2.6.36 deployments should assess exposure and verify authentication controls for config-fetching APIs. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that configuration data is properly protected.

Why it matters

CVE-2026-75338 allows anonymous attackers to read configuration items and files in disconf 2.6.36 due to Incorrect Access Control. Defenders should verify exposure, assess authentication controls, and restrict access to config-fetching APIs.

• Anonymous attackers can read configuration items and files
• Defenders need to verify exposure and restrict access to config-fetching APIs
• Configuration data may be at risk of unauthorized access

Technical summary

The disconf (Distributed Configuration Management Platform) 2.6.36 has a vulnerability in the config-fetching APIs /api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list, which are exposed without authentication due to the LoginInterceptor whitelisting these paths. This allows anonymous attackers to read configuration items and files, potentially leading to unauthorized access to sensitive information. Defenders should verify exposure, assess authentication controls, and restrict access to these APIs.

Defensive priority

Defenders should prioritize verifying exposure of disconf (Distributed Configuration Management Platform) 2.6.36 configuration items and files.

Recommended defensive actions

• Verify exposure of disconf 2.6.36 configuration items and files
• Assess authentication controls for config-fetching APIs
• Restrict access to config-fetching APIs
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry indicate that disconf 2.6.36 has Incorrect Access Control, exposing config-fetching APIs without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center. Evidence is limited to CVE and NVD details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.