CVE-2026-21994

Summary

Oracle OKIT (oci-designer-toolkit) version 0.3.0 contains two critical misconfigurations that chain into an unauthenticated full takeover. A hardcoded Flask SECRET_KEY exposed in the public repository allows any attacker to forge a valid admin session cookie — no credentials required. Separately, the Docker image disables SSH host verification entirely, enabling a network attacker to intercept OCI API keys and private keys during infrastructure deployments.

Vulnerability

1. Hardcoded SECRET_KEY — okitclassic/okitserver/config.py:4

SECRET_KEY='8980ffsd675747jjjh'

Flask uses this key to sign session cookies. Since it is hardcoded in a public repo, an attacker can forge a valid admin cookie and access the OKIT dashboard with zero credentials.

2. SSH Host Verification Disabled — Dockerfile:41