CVE-2026-50870: Information Disclosure in whoogle-search v1.2.3 Configuration Endpoint

Technical summary

CVE-2026-50870 is an information disclosure flaw (CWE-200) in the configuration endpoint of Ben Busby's whoogle-search v1.2.3. The vulnerability allows unauthenticated, remote attackers to retrieve sensitive configuration data via a crafted GET request. The attack vector is network-based with low complexity; no authentication, privileges, or user interaction are needed. The impact is confined to confidentiality; integrity and availability of the system remain unaffected. CVSS v3.1 score is 7.5 (HIGH).

Business impact

Compromise of whoogle-search configuration could expose API credentials, authentication secrets, or internal system parameters that attackers might use to pivot into downstream services or impersonate legitimate requests. For organizations running whoogle-search as a privacy-focused search proxy, this leak threatens the confidentiality of their entire search infrastructure and potentially exposes integration points with other tools or services.

Affected systems

Ben Busby whoogle-search version 1.2.3 is affected. Users running later versions should verify patch status against the vendor advisory. The vulnerability is unauthenticated and network-accessible, so any instance exposed to untrusted networks (including the internet) is at risk.

Exploitability

This vulnerability presents a low barrier to exploitation. An attacker needs only network access to the vulnerable endpoint and knowledge of the configuration path; no authentication or special client capabilities are required. The attack is a simple HTTP GET request with no user interaction dependency. Automated scanning tools can easily identify vulnerable instances and retrieve sensitive data at scale.

Remediation

Immediately upgrade whoogle-search to a patched version beyond 1.2.3. If immediate patching is not feasible, implement network-level access controls (firewall rules, WAF) to restrict access to the configuration endpoint to trusted sources only. Rotate any credentials or API keys that may have been exposed through this endpoint. Review audit logs for unauthorized access to the configuration path.

Patch guidance

Consult the Ben Busby whoogle-search project repository or release notes for the earliest available patch after v1.2.3. Apply the update to all affected instances. Testing should verify that the configuration endpoint no longer leaks sensitive data and that legitimate functionality remains intact. Consider automating deployment and rollout testing in a staging environment first.

Detection guidance

Monitor for GET requests to known configuration paths on whoogle-search instances (such as /config, /api/config, or similar). Alert on successful responses (HTTP 200) from unauthenticated clients or from unexpected source IPs. Log and review any historical access to these endpoints. Network intrusion detection systems should flag GET requests to configuration endpoints from external sources. Review web server logs for unusual query patterns targeting configuration endpoints.

Why prioritize this

Score a HIGH priority. The CVSS 7.5 reflects the combination of network accessibility, lack of authentication, low attack complexity, and high confidentiality impact. While the vulnerability does not enable remote code execution or service disruption, the exposure of configuration secrets can enable lateral movement, credential theft, and further compromise. The low bar to exploitation amplifies risk, especially for internet-facing instances.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects: network attack vector (AV:N) requiring no privileges (PR:N) or user interaction (UI:N), low attack complexity (AC:L), and universal scope (S:U). The high confidentiality impact (C:H) of leaked configuration data drives the severity, while lack of integrity or availability impact (I:N, A:N) prevents it from reaching CRITICAL. Organizations should treat this as a high-priority patch for any exposed instance.

Frequently asked questions