CVE-2026-92749

SafeLine, an open-source web application firewall, derives the secret used to sign management-console session cookies from a weakly seeded math/rand generator (CWE-338), making the key reconstructable offline. An unauthenticated remote attacker who can narrow the window of when the instance was installed can regenerate the session-signing secret and forge valid administrator session cookies. Successful exploitation grants full admin access to the management console, letting the attacker change WAF rules, inspect or manipulate traffic, and effectively control the protected sites. All SafeLine deployments at version 9.4.1 or earlier are affected, with the greatest risk on instances whose console is internet-facing. No public proof-of-concept or in-the-wild exploitation has been reported, and the flaw is not on CISA's KEV.

What to do: Upgrade SafeLine to a fixed release beyond 9.4.1 as soon as one is available and, where possible, regenerate the console's secret by reinstalling/upgrading. Until patched, restrict the management console to trusted networks (VPN or IP allowlist) and verify it is not exposed to the internet, since the attack requires no credentials or user interaction. Review console logs for unexplained administrator sessions or rule changes that could indicate forged-cookie access.