CVE•Published 2026-08-05•Modified 2026-08-26•1 article on news•4 live references•NVD data
CVE-2026-71238
Vulnerability data via NVD (ingested)
CVSS v3.1
9.1
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS percentile
24
Exploit Prediction Scoring System · top 76% of all CVEs
Weaknesses (CWE)
Description
DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.
Timeline
Published 2026-08-05
Modified 2026-08-26
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
More intel sources (5)
Shodan report
vuln:CVE-2026-71238Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2026-71238Censys host search filtered to this CVE id.
grep.app
CVE-2026-71238Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2026-71238GitHub code search for direct mentions.
Google dork
"CVE-2026-71238" exploit -site:nvd.nist.govWrite-ups and news, NVD excluded.
Known PoCs on GitHub (2)
CVE-2026-712382 repos
1dayexploit/1day-archivePython
Technical deep-dives and root cause analyses of recently disclosed CVEs - reverse engineering patches, building proof-of-concepts, and documenting exploitation techniques in the 1-…
jshDevs/CVE_kernellinux_jshShell
Framework modular Bash para auditar CVE-2026-31431 (CopyFail) y CVEs relacionados del kernel Linux en distros RPM-based (AlmaLinux, Rocky, CentOS Stream 8/9/10)