Cryptographic Vulnerability in dromara Orion-Visor Affects Key Management
CVE-2026-90510

6.9MEDIUM

Key Information:

Vendor

Dromara

Status
Orion-visor
Vendor
CVE Published:
13 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-90510?

A security issue has been identified within dromara's Orion-Visor, specifically in the HostKeyServiceImpl.encryptKey function. This vulnerability results from the use of hard-coded cryptographic keys, which can be exploited remotely. The potential unauthorized access to sensitive data, such as SSH private keys and passwords, raises significant security concerns. Despite being notified of this critical flaw through an issue report, the project has yet to take action to address the vulnerability, underlining the urgency for implementation of best practices in key management.

Affected Version(s)

orion-visor 2.5.0

orion-visor 2.5.1

orion-visor 2.5.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-90510 - Proof of Concept

References

https://vuldb.com/vuln/403098
vdb-entrytechnical-description
https://vuldb.com/vuln/403098/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90510
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

summmm (VulDB User)
VulDB CNA Team
.