Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-105030Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API

Medium 5.3

In plain English

A medium-severity information exposure in kener from rajnandan1. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 73.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed monitor tag to endpoints such as monitor-bar and monitor-latency-chart to obtain names, descriptions, status, uptime history and latency.

Affected products (as reported)

Vendor	Product	Versions
rajnandan1	kener	4.0.0 – before 4.1.6

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Issue #848 issue-tracking
https://github.com/rajnandan1/kener/commit/e8ce31898bf73ffe6be07c9b299da2a7330ddba5 patch
https://github.com/rajnandan1/kener product
VulnCheck Advisory: Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API third-party-advisory