CVE-2026-114366

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114366", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "Qt", "dateReserved": "2026-10-21T09:53:58.584Z", "datePublished": "2026-11-06T04:40:04.282Z", "dateUpdated": "2026-11-10T13:57:01.661Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-11-06T04:40:04.282Z"}, "title": "Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-226", "description": "CWE-226 Sensitive Information in Resource Not Removed Before Reuse", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "affected": [{"vendor": "qt", "product": "Qt Framework", "modules": ["qtwebsockets"], "versions": [{"status": "unknown", "version": "0", "lessThan": "6.6.0", "versionType": "python"}, {"status": "affected", "version": "6.6.0", "lessThan": "6.8.10", "versionType": "python"}, {"status": "affected", "version": "6.9.0", "lessThan": "6.11.3", "versionType": "python"}, {"status": "affected", "version": "6.12.0", "lessThan": "6.12.1", "versionType": "python"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "cpe:2.3:a:qt:qtwebsockets:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module."}]}], "references": [{"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-114366", "tags": ["vendor-advisory"]}, {"url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772273", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "GREEN", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/RE:L/U:Green"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T13:56:44.678688Z", "id": "CVE-2026-114366", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T13:57:01.661Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114366", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "Qt", "dateReserved": "2026-10-21T09:53:58.584Z", "datePublished": "2026-11-06T04:40:04.282Z", "dateUpdated": "2026-11-10T13:57:01.661Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-11-06T04:40:04.282Z"}, "title": "Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-226", "description": "CWE-226 Sensitive Information in Resource Not Removed Before Reuse", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "affected": [{"vendor": "qt", "product": "Qt Framework", "modules": ["qtwebsockets"], "versions": [{"status": "unknown", "version": "0", "lessThan": "6.6.0", "versionType": "python"}, {"status": "affected", "version": "6.6.0", "lessThan": "6.8.10", "versionType": "python"}, {"status": "affected", "version": "6.9.0", "lessThan": "6.11.3", "versionType": "python"}, {"status": "affected", "version": "6.12.0", "lessThan": "6.12.1", "versionType": "python"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "cpe:2.3:a:qt:qtwebsockets:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module."}]}], "references": [{"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-114366", "tags": ["vendor-advisory"]}, {"url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772273", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "GREEN", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/RE:L/U:Green"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114366", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T13:56:44.678688Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T13:56:56.268Z"}}]}}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "cpe:2.3:a:qt:qtwebsockets:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["qtwebsockets"], "product": "Qt Framework", "vendor": "qt", "versions": [{"lessThan": "6.6.0", "status": "unknown", "version": "0", "versionType": "python"}, {"lessThan": "6.8.10", "status": "affected", "version": "6.6.0", "versionType": "python"}, {"lessThan": "6.11.3", "status": "affected", "version": "6.9.0", "versionType": "python"}, {"lessThan": "6.12.1", "status": "affected", "version": "6.12.0", "versionType": "python"}]}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module."}], "id": "CVE-2026-114366", "lastModified": "2026-11-10T14:17:13.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "GREEN", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114366", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T13:56:44.678688Z", "version": "2.0.3"}}]}, "published": "2026-11-06T05:18:20.220", "references": [{"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772273"}, {"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-114366"}], "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-226"}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}]}

{"bugzilla": {"description": "qt6-qtwebsockets: Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework", "id": "2568040", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568040"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A flaw was found in Qt. Improper authentication handling in the QWebSocket component of the Qt WebSockets module allows an attacker to cause an information disclosure. A remote attacker could exploit this vulnerability to gain unauthorized access to sensitive data."], "mitigation": {"lang": "en:us", "value": "Disable unauthenticated WebSocket endpoints or restrict network access to trusted clients via reverse proxy authentication controls until an update can be applied."}, "name": "CVE-2026-114366", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "qt6-qtwebsockets", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Fix deferred", "package_name": "qt5", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Fix deferred", "package_name": "qt6", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-06T04:40:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114366\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114366\nhttps://codereview.qt-project.org/c/qt/qtwebsockets/+/772273\nhttps://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-114366"], "statement": "An information disclosure vulnerability exists in Qt Framework's QWebSocket authentication handling within the Qt WebSockets module, where improper handling of authentication credentials or state during WebSocket handshakes allows an unauthenticated remote attacker to expose sensitive information.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "qt", "vendor": "qt"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.0,6.8.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.9.0,6.11.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.0,6.12.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Qt Framework", "source": "cna", "vendor": "qt"}, "product": "qt_framework", "vendor": "qt"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "qtwebsockets", "vendor": "qt"}], "created": "2026-11-06T05:30:15.561304+00:00", "updated": "2026-11-07T02:00:08.813058+00:00", "vendors": ["qt", "qt$PRODUCT$qt", "qt$PRODUCT$qt_framework", "qt$PRODUCT$qtwebsockets"]}