CVE-2026-39908: OpenBullet2 NTLMv2 Hash Disclosure via UNC Proxy Path

Technical summary

The vulnerability exists in OpenBullet2's proxy source handling on Windows. When a job is configured with a UNC path (e.g., \\attacker.com\share) pointing to a proxy source, the application initiates an SMB connection during job startup to retrieve proxy information. The Windows authentication layer transparently attempts NTLM authentication to access the remote resource. An attacker-controlled SMB server captures the outbound NTLMv2 hash sent by the client. This hash can be relayed to other services using NTLMv2 relay techniques or subjected to offline brute-force or dictionary attacks. The flaw stems from inadequate validation or sanitization of proxy source paths and failure to restrict network protocols to secure channels. CWE-522 (Insufficiently Protected Credentials) applies because sensitive authentication material is disclosed without adequate protection during the connection attempt.

Business impact

Compromise of Windows user credentials running OpenBullet2 creates cascading risks. The leaked hash may grant attackers access to the user's network resources, domain accounts (if domain-joined), and downstream systems the user can reach. In environments where OpenBullet2 runs under elevated or service account contexts, the impact extends to critical infrastructure. Attackers could pivot laterally, access sensitive data, or establish persistence. The threat is compounded if the compromised account has administrative privileges or access to highly sensitive systems.

Affected systems

OpenBullet2 version 0.3.2 and earlier releases on Windows are vulnerable. The Windows operating system is a prerequisite; the vulnerability does not affect Linux or macOS deployments. Affected organizations include penetration testers, security researchers, and potentially threat actors who use or deploy OpenBullet2 in their workflow.

Exploitability

Exploitation requires network access and valid credentials or permission to configure OpenBullet2 jobs. An insider, compromised account, or attacker with prior foothold can create a malicious proxy job configuration. The attack vector is network-based, requires authentication to the application, and does not need user interaction beyond job execution. No complex techniques or race conditions are required; the vulnerability triggers automatically when a job with a UNC proxy path is started. The barrier to weaponization is low once access is gained.

Remediation

Upgrade OpenBullet2 to a version newer than 0.3.2 that includes fixes for credential disclosure during proxy source resolution. Verify patched versions against the official OpenBullet2 repository or vendor advisory. Until patches are available, restrict network access to OpenBullet2 instances, prevent untrusted users from configuring job proxy sources, and run the application under a low-privilege account with minimal network rights. Consider disabling SMB-based proxy sources or validating proxy paths to exclude UNC paths.

Patch guidance

Check the official OpenBullet2 project repository for versions released after 0.3.2 that address CVE-2026-39908. Apply the latest stable release to all Windows systems running OpenBullet2. Verify patch application by confirming the version number in the application settings or file properties. Test patched versions in a controlled environment before production deployment to ensure compatibility with existing job configurations.

Detection guidance

Monitor for SMB authentication attempts originating from OpenBullet2 processes connecting to unusual or external hosts. Use Windows Event Log monitoring to detect failed or anomalous NTLM authentication events from the OpenBullet2 service account. Inspect job configuration files for UNC paths pointing to unexpected network resources. Network-level detection should flag SMB traffic from internal systems to external or unknown IP addresses. EDR solutions can track process-to-network behaviors characteristic of credential capture attempts.

Why prioritize this

Although assigned MEDIUM severity (CVSS 6.5), this vulnerability poses direct credential theft with minimal barriers to exploitation for insiders or attackers with initial access. The leaked NTLMv2 hash enables relay attacks and offline cracking, potentially leading to lateral movement and privilege escalation. Prioritize patching in environments where OpenBullet2 runs on domain-joined systems, under privileged accounts, or with access to sensitive infrastructure. Organizations using OpenBullet2 for legitimate security testing should treat patching as urgent.

Risk score, explained

CVSS 6.5 (MEDIUM) reflects network accessibility, requirement for authenticated access, and high confidentiality impact (hash disclosure) with no integrity or availability consequences. The score does not fully capture the downstream damage potential from NTLMv2 relay or password cracking. Real-world risk depends on the account privileges running OpenBullet2, network segmentation, and whether NTLMv2 relay mitigations (SMB signing, EPA) are in place. Security teams should supplement CVSS with contextual risk assessment.

Frequently asked questions