CVE-2026-102663 OpenListTeam CVE debrief

Who should care

Defenders responsible for OpenList deployments should assess exposure and prioritize upgrading to version 4.2.4 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security and integrity of their OpenList deployments. Affected deployments should take immediate action to mitigate the vulnerability and prevent potential disclosure of sensitive information.

Why it matters

Defenders should care about CVE-2026-102663 as it allows unauthorized disclosure of file metadata or file-existence information in OpenList deployments prior to version 4.2.4.

• Potential disclosure of unauthorized file metadata
• Potential disclosure of file-existence information
• Reveal backend Total value indicating a match

Technical summary

OpenList's search API uses a non-separator-aware strings.HasPrefix comparison, allowing unauthorized disclosure of file metadata or file-existence information. This vulnerability affects OpenList deployments prior to version 4.2.4. The issue arises from the path check vulnerability in the Bleve search functionality, which can be exploited to disclose sensitive information. Defenders should prioritize verifying and upgrading to OpenList version 4.2.4 or later to address the vulnerability. The CVE record and source item provide additional details on the vulnerability, including its description and affected versions.

Defensive priority

Defenders should prioritize verifying and upgrading to OpenList version 4.2.4 or later to address the path check vulnerability.

Recommended defensive actions

• Verify OpenList version and upgrade to 4.2.4 or later
• Review and restrict search API access
• Monitor for suspicious search activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The vulnerability was introduced due to a non-separator-aware path check in the Bleve search functionality of OpenList. This allows an attacker to potentially disclose file metadata or file-existence information. The CVE record was published on 2026-10-12T18:49:23.454Z and has not been modified since then. The source item details are also provided, offering additional context on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.