CVE-2026-108584

FunnyWolf Viper config hard-coded credentials

State: Published
Severity: 6.9 Medium
Published: Oct 11, 2026
Updated: Oct 15, 2026
Reserved: Oct 10, 2026

Description

A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C	VulDB

Weaknesses

CWE-798 Hard-coded Credentials
CWE-259 Use of Hard-coded Password

Affected Products

Product	Versions
ViperFunnyWolf	3.1.0Affected 3.1.1Affected 3.1.2Affected 3.1.3Affected 3.1.4Affected 3.1.5Affected 3.1.6Affected 3.1.7Affected 3.1.8Affected 3.1.9Affected 3.1.10Affected 3.1.11Affected

References

VDB-416236 | FunnyWolf Viper config hard-coded credentialsvdb-entry
VDB-416236 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-108584 | CVE Analysis and Reportthird-party-advisory
Submit #956815 | FunnyWolf Viper <=3.1.11 Hard-coded Credentialsthird-party-advisory
https://github.com/Randark-JMT/vulnerability-reports/blob/main/advisories/2026-09-02-viper-docker-git-credential-leak.mdexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.