Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108754GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger

Low 3.3

In plain English

A low-severity sensitive data in logs in gpt-load from tbphp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.1%top 98.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.

Affected products (as reported)

Vendor	Product	Versions
tbphp	gpt-load	0 – through 1.4.11

Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@haind03/tbphp-gpt-load-proxy-key-access-log-disclosure third-party-advisory
https://github.com/tbphp/gpt-load/blob/a12882be9e06011da5e0284db5dd4617a7ca6e6d/internal/middleware/middleware.go#L20-L74 technical-description
https://github.com/tbphp/gpt-load/blob/a12882be9e06011da5e0284db5dd4617a7ca6e6d/internal/middleware/middleware.go#L247-L254 technical-description
https://github.com/tbphp/gpt-load product
VulnCheck Advisory: GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger third-party-advisory