PatchSiren cyber security CVE debrief
CVE-2026-48245 Open ISES CVE debrief
CVE-2026-48245 describes a secret exposure issue in Open ISES Tickets before version 3.44.2. A Google Maps API key was hardcoded in tables.php and committed to the public source repository, making it readable by anyone with access to the code. Because the key could be reused to make Google Maps Platform requests charged to the original Google Cloud project, the issue creates both abuse and billing risk. The recorded CVSS score is 6.9 (Medium), and the weakness mapping is CWE-798, use of hard-coded credentials. The practical risk is not remote code execution; it is unauthorized use of a live API credential, potential quota exhaustion, and unexpected charges until the key is revoked or restricted.
- Vendor
- Open ISES
- Product
- Tickets
- CVSS
- MEDIUM 6.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-21
- Original CVE updated
- 2026-05-21
- Advisory published
- 2026-05-21
- Advisory updated
- 2026-05-21
Who should care
Maintainers and operators of Open ISES Tickets deployments, anyone who cloned or mirrored the affected repository, and Google Cloud administrators responsible for the exposed Maps API key and billing account.
Technical summary
According to the supplied disclosure, versions of Open ISES Tickets before 3.44.2 included a hardcoded Google Maps API key in tables.php and committed it to the public repository. That makes the credential trivially recoverable from source history. The impact is abuse of Google Maps Platform API access under the original project, with likely billing and quota consequences rather than direct system compromise. The issue is classified as CWE-798.
Defensive priority
High
Recommended defensive actions
- Upgrade Open ISES Tickets to v3.44.2 or later.
- Treat the exposed Google Maps API key as compromised and revoke or rotate it in Google Cloud.
- Check the Google Cloud project for unauthorized Maps API usage, quota spikes, or unexpected billing.
- Apply API key restrictions and usage limits so any replacement key is locked to the minimum required services and referrers.
- Review repository history and deployment artifacts for any additional hardcoded secrets.
- Set up billing alerts and API usage monitoring to catch future misuse quickly.
Evidence notes
This debrief is based only on the supplied CVE record and the referenced VulnCheck disclosure materials. The source corpus states that the affected code was committed publicly, that the issue was fixed in release v3.44.2, and that the weakness is CWE-798. The NVD record for this CVE is marked Deferred in the supplied metadata, so the product naming here follows the provided source context rather than an independently validated vendor profile.
Official resources
Published in the CVE/NVD record on 2026-05-21, with source references pointing to the upstream fix and VulnCheck advisory.