CERT/CC VU#653116 | CISA Advisory ICSA-26-055-03 | All CVEs | Case Repository

CVE-2026-32662: Active Debug Code in Production

Advisory

Product

Summary

Development and test API endpoints are present in the production environment that mirror production functionality. These endpoints historically provided access to production credentials with reduced or absent authentication controls. Additionally, development credentials and configuration are embedded in production mobile application and admin panel builds.

Vulnerability Details

Development API Endpoints

Multiple development and test API endpoints were discovered that parallel production infrastructure:

Historical Credential Leakage

The development API historically accepted the same provisioning requests as production and returned full production credentials including the IoT Hub iothubowner credential (CVE-2025-1242) — without authentication.

The development environment was configured with production credentials, meaning a compromise of the less-secured development environment granted full access to the production IoT Hub fleet.

Development Credentials in Production Builds

Development environment credentials and configuration were found embedded in production application artifacts:

Mobile application (index.android.bundle):

• Development API hostnames and endpoints
• Firebase development project credentials
• Test/staging environment connection strings

Admin panel JavaScript bundle (admin.gardyn.io):

• Development API endpoint leaked in production bundle ([REDACTED — Dev API host])
• Development environment credentials
• Debug configuration parameters
• Internal Azure resource identifiers

Production API Endpoint Enumeration

Analysis of the production bundles and Firebase Remote Config revealed the full production API surface:

Current Status

Development endpoints now return 403 Forbidden responses, indicating they have been blocked but the infrastructure remains deployed. Development credentials remain embedded in published mobile application builds.

Impact

• Historical credential leakage via development endpoints (production iothubowner key was accessible)
• Development credentials in production builds enable environment discovery and targeted reconnaissance
• Parallel development environments with production credentials create alternate attack paths
• Internal API surface enumeration aids exploitation of other vulnerabilities
• Risk of future re-exposure if access controls on development endpoints are relaxed

Standard Services Available for This Class of Endpoint

Azure provides built-in environment separation and deployment controls that prevent development code from reaching production:

Remediation

Gardyn recommends upgrading to Cloud API version 2.12.2026 or later. See https://mygardyn.com/security/ for additional information.

Recommended fix for the vendor:

1. Decommission publicly-routable development endpoints entirely
2. Implement network segmentation isolating non-production environments from the internet
3. Never use production credentials in development environments
4. Remove development hostnames, credentials, and debug configuration from production application builds
5. Strip debug symbols, build paths, and environment metadata from production bundles
6. Implement a build pipeline that validates no development artifacts are present in release builds
7. Conduct regular audits of exposed Azure Web App endpoints

Timeline

References

• CVE-2026-32662 -- CVE Record
• ICSA-26-055-03
• CWE-489: Active Debug Code

Credit

Reported by Michael Groberman — Gr0m to CISA.