CVE-2026-116282 Kameleo CVE debrief

Who should care

Defenders responsible for Kameleo installations, particularly those using versions up to 5.3.1, should assess exposure and prioritize verification and mitigation. Defenders should also review compensating controls for exposed systems, check relevant monitoring and logs, and track exceptions. This vulnerability affects Kameleo's Cookie Controller and allows for remote information disclosure.

Why it matters

CVE-2026-116282 is a medium-severity vulnerability in Kameleo's Cookie Controller. Defenders should verify affected versions, assess exposure, and limit access to prevent remote information disclosure.

• Remote information disclosure is possible
• Defenders must verify Kameleo versions and limit access
• Exposure assessment is required for Kameleo installations

Technical summary

The vulnerability is in the CookieController.ListCookies function of Kameleo's client-engine-application/w.cs file. The guid argument can be manipulated to disclose information remotely. This issue allows for remote information disclosure and defenders should prioritize verifying the affected Kameleo versions and assessing exposure. The attack can be executed remotely, and the vendor was contacted early about this disclosure but did not respond in any way. The vulnerability has a medium severity and defenders should verify affected Kameleo versions and limit access.

Defensive priority

Defenders should prioritize verifying the affected Kameleo versions and assessing exposure, as the vulnerability allows for remote information disclosure.

Recommended defensive actions

• Verify Kameleo version and assess exposure
• Review and limit access to CookieController.ListCookies
• Monitor for potential remote information disclosure attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, but vendor comments or additional impact information are not available. Defenders should verify affected Kameleo versions, assess exposure, and limit access to prevent remote information disclosure. The CVE record was published on 2026-10-26T13:15:17.127Z and has not been modified since then. The source item details are also provided, but no additional information is available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.