Planet9 Hardcoded Credentials Vulnerability Information
Summary
| CVE | CVE-2026-50601 |
|---|---|
| State | PUBLISHED |
| Assigner | Acer |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-17 03:16:50 UTC |
| Updated | 2026-08-17 16:16:58 UTC |
| Description | A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain administrative access to repository infrastructure and modify software source code. To mitigate this security risk, Acer has released an update to resolve the issue. |
Risk And Classification
Primary CVSS: v4.0 6.6 MEDIUM from 8fc372e3-d9c5-46e4-9410-38469745c639
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002390000 probability, percentile 0.152520000 (date 2026-08-17)
Problem Types: CWE-798 | CWE-798 CWE-798: Use of Hard-coded Credentials
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 8fc372e3-d9c5-46e4-9410-38469745c639 | Secondary | 6.6 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/C... |
| 4.0 | CNA | CVSS | 6.6 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Acer | Planet9 Desktop Application | affected 2.6.131 2.8.124 custom | Windows, 64 bit |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| community.acer.com/en/kb/articles/19869 | 8fc372e3-d9c5-46e4-9410-38469745c639 | community.acer.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Ayush Choudhary (en)
Additional Advisory Data
Solutions
CNA: Planet9 Version v2.8.128 contains a resolution to this vulnerability. The application will automatically update to the patched version (v2.8.128) in the background.