LeakyCreds
NewInstant webhook alerts now available ā€” notified within seconds of any credential detection.Learn more ā†’
Home / Vulnerability Intelligence / CVE-2026-43992

CVE-2026-43992 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: May 12, 2026

JunoClaw - Information Disclosure

Published: May 12, 2026Updated: May 12, 2026Remote Exploitable

Overview

JunoClaw < 0.x.y-security-1 contains an information disclosure vulnerability caused by embedding BIP-39 seed mnemonic in LLM tool-call JSON, letting attackers access sensitive seed data, exploit requires interception of transport or logs.

Severity & Score

Severity: Critical
CVSS Score: 9.8
EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Attackers can access sensitive mnemonic seeds, potentially compromising wallet security and funds.

Mitigation

Update to version 0.x.y-security-1 or later.

References

Social Media Activity(4 posts)

TheHackerWire
TheHackerWire
@thehackerwire
May 12, 2026

šŸ”“ CVE-2026-43992 - Critical (9.8) JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call p... šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-43992/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
TheHackerWire
TheHackerWire
@thehackerwire
May 12, 2026

šŸ”“ CVE-2026-43992 - Critical (9.8) JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call p... šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-43992/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
TheHackerWire
TheHackerWire
@thehackerwire
May 12, 2026

šŸ”“ CVE-2026-43992 - Critical (9.8) JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call p... šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-43992/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
TheHackerWire
TheHackerWire
@thehackerwire
May 12, 2026

šŸ”“ CVE-2026-43992 - Critical (9.8) JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call p... šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-43992/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

Details

CVE ID
CVE-2026-43992
Severity
Critical
CVSS Score
9.8
Type
information_disclosure
Status
new
EPSS
0.0%
Social Posts
4

CWE

  • CWE-200

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.0%Probability of exploitation in the next 30 days