Missing Authorization in SysClientController of Pig Before 4.1.2
CVE-2026-125377

7.1HIGH

Key Information:

Vendor

Pig-mesh

Status
Pig
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125377?

A missing authorization vulnerability exists in the SysClientController of Pig versions prior to 4.1.2. This flaw allows authenticated users lacking client-management permissions to access sensitive OAuth2 client secrets through the endpoints GET /client/{clientId} and GET /client/export. Attackers may exploit this vulnerability to obtain clientSecret values associated with seed clients, such as pig, app, and daemon, or to export the client table, leading to potential misuse of tokens configured for those clients. Immediate remediation is necessary to mitigate risks associated with unauthorized access to sensitive information.

Affected Version(s)

pig 0 < 4.1.2

References

https://github.com/pig-mesh/pig/issues/1298
issue-tracking
https://github.com/pig-mesh/pig
product
https://github.com/pig-mesh/pig/blob/a0d273afd3adc6678b06...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.