CVE-2026-39031: Lansweeper Hardcoded Encryption Key Enables Local Password Recovery

Technical summary

CVE-2026-39031 exploits a cryptographic implementation flaw in Lansweeper's credential storage mechanism. Both lsrunase 2.0 and lsencrypt 2.0 encrypt stored credentials using RC4 with a static, hardcoded 142-byte key. The presence of a cleartext 8-character prefix alongside the ciphertext enables deterministic decryption: an attacker with local file system access can extract encrypted credentials, apply SHA-1 hashing and RC4 decryption using the known key, and recover plaintext passwords without computational search. This violates fundamental cryptographic practices (unique keys per credential, sufficient entropy in keying material). The vulnerability is classified under CWE-321 (Use of Hard-Coded Cryptographic Key).

Business impact

Organizations relying on Lansweeper for IT asset and credential management face password compromise if their systems are breached or accessed by insiders. Compromised credentials could allow lateral movement, privilege escalation, or unauthorized access to critical infrastructure managed through Lansweeper. The impact is amplified in environments where Lansweeper stores credentials for domain administrators, cloud service accounts, or other high-privilege identities. Incident response will require credential rotation and access log review across all systems where compromised passwords were in use.

Affected systems

Lansweeper lsrunase 2.0 and lsencrypt 2.0 are affected. Verify your installed versions and patch status against Lansweeper's vendor advisory. Any system running these components that stores or manages credentials is at risk if local access is obtained.

Exploitability

Exploitability is moderate and localized. The attack requires local file system access to retrieve encrypted credential stores—not a remote, unauthenticated attack. However, the barrier to exploitation once access is gained is extremely low: no brute force, no advanced tooling, only straightforward application of SHA-1 and RC4 using a known key. Any user or process with read permissions to credential storage locations can decrypt passwords, making this a significant post-compromise or insider threat risk.

Remediation

Apply security updates from Lansweeper that replace the hardcoded key and RC4 cipher with modern encryption (AES-GCM or equivalent) and unique, randomly generated per-credential keys. Until patching is complete, restrict local file system access to credential storage locations through OS-level permissions and file integrity monitoring. Consider rotating credentials stored in affected Lansweeper instances, especially for privileged accounts.

Patch guidance

Consult Lansweeper's official security advisory for patch availability and version numbers for lsrunase and lsencrypt. Deploy patches in a test environment first to validate compatibility with your Lansweeper deployment before production rollout. If patches are not yet available, maintain air-gapped or restricted-access deployments of affected components.

Detection guidance

Monitor for unauthorized reads of Lansweeper credential storage files using endpoint detection and response (EDR) tools or host-based file integrity monitoring. Audit local user and process access to file paths where lsrunase and lsencrypt store encrypted credentials. Review authentication logs for anomalous account activity post-compromise. If possible, test password recovery on a non-production instance to establish baseline file hashes and access patterns.

Why prioritize this

Although the CVSS score is MEDIUM (5.5), this vulnerability warrants high priority because it enables direct, deterministic credential extraction with no computational barrier once local access is obtained. In environments where Lansweeper manages privileged credentials, compromise could cascade into broader infrastructure attacks. Organizations with strong local access controls and credential governance may rate this lower; those with weak file permissions or high-privilege credential storage should treat it as urgent.

Risk score, explained

The CVSS:3.1 score of 5.5 (MEDIUM) reflects the local attack vector (AV:L) and requirement for low privilege (PR:L), balanced against high confidentiality impact (C:H) and no integrity or availability impact. The score appropriately captures the attack's limited reach (local only) but underrepresents the severity in practice: credential theft is often a precursor to enterprise-wide compromise, and the lack of computational difficulty amplifies real-world risk. Supplement the CVSS score with asset criticality and credential sensitivity when prioritizing.

Frequently asked questions