PT-2026-145394

CVE-2026-126767

·

Published

2026-11-11

·

Updated

2026-11-11

Description by

CVSS 3.1
4.3
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks.
Exploitability
Exploit
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-1427: Improper Neutralization of Input Used for LLM Prompting
Related identifiers
CVE-2026-126767
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com