CVE-2026-74892

The EPSS score of 0.00306 for CVE-2026-74892 will mislead you if you treat it as a normal vulnerability metric. This is a hardcoded API key in a standalone telemetry server configuration, and EPSS fundamentally breaks when scoring default secrets—because exploitability isn't a technical question, it's a single binary: has the key already reached attackers? Once someone knows this key, there's no vulnerability to find, no exploit to develop. They've already won. The real exposure question isn't whether this key is in wordlists today—it's whether your organization can verify it isn't. Telemetry servers authenticate before they generate any telemetry about themselves, creating a bootstrapping problem that systematically pressures developers toward hardcoded defaults. This is the same genetic sequence as default SNMP community strings, hardcoded Oracle passwords, and AWS keys in public AMIs—each iteration different, the pattern identical. Here's what matters practically: investigate whether your deployment uses the standalone telemetry server configuration and whether it's default-on or opt-in. That distinction changes exposure dramatically. More critically, treat any hardcoded default credential in authentication pathways as a severity escalation candidate regardless of EPSS—your SAST pipeline likely flags these as 'medium' by default, training your team to deprioritize exactly the finding that matters most here. The compounding risk: this CVE will enter every automated scanner the moment it's published. If the default key has circulated in any configuration management runbooks, early documentation, or internal commits, you have a compromised sensor—not just a vulnerable component. And you probably won't know, because telemetry systems are trusted by definition: how do you detect manipulation of the data that tells you whether you've been compromised? The patch at 1.4.0 changes the default value, but orphaned telemetry instances that never receive updates may persist indefinitely. If you can't enumerate every telemetry server in your environment, you're not managing this vulnerability—you're hoping.

Reviewed through automated stages and approved by a human before publication.