Sensitive Information Exposure in ZenHive mpp for Elixir Applications

CVE-2026-89186

What is CVE-2026-89186?

The ZenHive mpp library for Elixir is vulnerable to sensitive information exposure due to the improper handling of HTTP cache responses. In specific versions, the library allows a shared HTTP cache to mistakenly store a response meant only for clients who have completed payment, enabling unauthorized access to this content. The issue arises when the application's cache-control headers can override the private cache-control settings that are supposed to protect sensitive information, allowing unauthorized users to access paid content. This vulnerability can lead to significant data leakage if not addressed, as it enables unintended dissemination of sensitive information.

References