What is GHSA-qfjw-8qqh-5c6x?

GHSA-qfjw-8qqh-5c6x is a security advisory published by GitHub Security Advisories with Critical severity. The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web...

Which CVE IDs does GHSA-qfjw-8qqh-5c6x cover?

GHSA-qfjw-8qqh-5c6x covers the following CVE IDs: CVE-2026-18754. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qfjw-8qqh-5c6x?

GHSA-qfjw-8qqh-5c6x has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-qfjw-8qqh-5c6xCriticalCVSS 9.1

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web...

Vendor

GitHub Security Advisories

Published

August 4, 2026

Last Modified

August 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-18754 →

📋 Description

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-18754
https://www.geovision.com.tw/cyber_security.php
https://github.com/advisories/GHSA-qfjw-8qqh-5c6x