CVE-2026-100710

Executive Summary

CVE-2026-100710 is a sensitive information disclosure vulnerability in the Froxlor server management panel through version 2.3.10. The Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() API methods execute wildcard SELECT statements against the panel_domains table and return rows unmodified, including the panel_domains.dkim_privkey column. An authenticated non-superadmin administrator who holds the delegated customers_see_all flag can retrieve the DKIM private signing keys of domains owned by other tenants. Disclosed keys enable an attacker to forge DKIM-valid, DMARC-aligned email for affected domains, undermining the integrity of outbound email authentication.

Technical Analysis

Froxlor is a lightweight web hosting control panel used to manage domains, mail, and customer accounts. This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and resides in the panel's API layer.

The core mechanism is a response-filtering failure rather than an injection or authentication bypass. The affected methods — Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() — read from the panel_domains table using a wildcard SELECT. Wildcard selection causes every column in the row to be returned, and the code path in these methods does not subsequently filter sensitive columns out of the response object; the row is returned unmodified. The sensitive column in scope is panel_domains.dkim_privkey, which stores the DKIM private signing key material for each domain.

Access control context is critical to understanding the exposure. The vulnerable methods are reachable by an authenticated administrative user who is not a superadmin but who has been delegated the customers_see_all flag. This flag is intended to allow a scoped administrator to view resources across customer tenants for management purposes. However, because the API response is not sanitized, the delegated visibility extends to cryptographic key material that the operator should not be able to read. The NVD description explicitly notes that a single listing call discloses the key for every visible domain — making bulk exfiltration trivial rather than laborious.

This CVE is described as a follow-on to an earlier, incomplete fix. A prior remediation stripped password and data_2fa columns from these responses but failed to include dkim_privkey in the denylist/filter, leaving the key material exposed. This is a classic allowlist/denylist maintenance failure: handling sensitive fields by enumerating them individually means new or overlooked sensitive columns remain exposed. The correct approach is to return an explicit, minimal set of fields (allowlist) or to strip all fields matching a sensitive classification.

Because the flaw is in output filtering rather than input validation, there is no injection vector and no unauthenticated attack surface. The CVSS vector reflects this: AV:N (network-reachable API), AC:L (no special conditions), PR:H (requires an administrative account), UI:N (no user interaction), S:U (impact confined to the vulnerable component's scope), C:H (confidentiality of key material is fully lost), I:N and A:N (no direct integrity or availability impact within the panel itself). The CVSS base score is 4.9.

Insufficient technical detail is available to specify exact API routes, parameter names, or the precise implementation of the filtering logic; the analysis above is limited strictly to what the NVD description provides.

Exploitation Scenarios

No public PoC is available for CVE-2026-100710. The attack chain below is inferred from the vulnerability class (sensitive data exposure via unfiltered API response) and the specific details supplied in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Froxlor installation (version ≤ 2.3.10) that exposes its panel/API over the network. An attacker already possessing some foothold is required: they must hold a valid authenticated session for an account that is an administrator but not a superadmin, and that account must carry the delegated customers_see_all flag. The realistic threat actor here is therefore a lower-privileged delegated administrator, a malicious insider, or an external attacker who has compromised such a delegated account. The attacker enumerates API-accessible domains to determine which tenant domains are visible to their account.

2. Triggering the flaw class. The attacker issues calls to the affected methods — Domains.get, Domains.listing, SubDomains.get, or SubDomains.listing (admin branch). Because these methods perform a wildcard SELECT over panel_domains and return the row unmodified, the response includes the panel_domains.dkim_privkey field. No exploit payload, malformed input, or boundary condition is required; the disclosure is the default behavior of the endpoint for an authorized caller. A single listing invocation returns the key material for every domain visible to the caller.

3. Payload / execution method (vulnerability-class level). This is not a code-execution vulnerability. The "payload" is simply a well-formed authenticated API request; the "execution" is the server returning unfiltered data. The attacker collects the leaked dkim_privkey values from the responses. Because filtering targeted only password and data_2fa in the prior fix, the DKIM private key is present in-band rather than redacted.

4. Post-exploitation impact. With one or more domains' DKIM private signing keys, the attacker can sign outbound email such that it passes DKIM verification for those domains. If the victim domains publish DMARC policies with alignment, the attacker can also achieve DMARC alignment for the affected domains, making spoofed or injected mail far more likely to reach recipients' inboxes and survive authentication checks. This directly enables credible phishing, business email compromise, and brand impersonation from legitimate-looking domains. The confidentiality impact is rated High in the CVSS vector, reflecting the sensitivity of private signing key material. There is no direct integrity or availability impact within the Froxlor panel itself.

Impact Assessment

The primary impact is the compromise of DKIM private signing keys for all domains visible to a delegated administrator. Because DKIM keys are cryptographic secrets whose integrity underpins email authentication, disclosure is effectively irreversible by reconfiguration alone — affected keys must be rotated. The blast radius is bounded by the customers_see_all scope of the compromised account, but the description states that a single listing call discloses the key of every visible domain, so the practical blast radius for a broadly scoped delegated admin can be large: every tenant domain visible to that operator.

Business consequences include erosion of email trust for affected domains, potential regulatory exposure where email authentication integrity is a control (e.g., anti-phishing and anti-fraud regimes), and downstream brand and customer harm from successful impersonation. CVSS subscores align with this profile: Confidentiality is High (C:H) because private key material is fully exposed; Integrity (I:N) and Availability (A:N) are unaffected, and Scope is Unchanged (S:U), meaning impact is contained within the affected panel/communication context rather than crossing a security authority boundary. The vector requires High privileges (PR:H) and no user interaction (UI:N).

Because private key material is involved, the exposure should be treated as persistent: keys do not "expire" the moment the vulnerable method is patched. Any key observed by an unauthorized party must be considered compromised.

Detection Guidance

Sigma Rule

title: Froxlor API DKIM Private Key Disclosure (CVE-2026-100710)
id: 7b9c2f14-4a3e-4c8d-9e21-froxlor100710
status: experimental
description: Detects authenticated API calls to Froxlor domain/subdomain listing or get methods by delegated administrators, which may disclose panel_domains.dkim_privkey.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100710
author: Security Team
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-uri-query|contains:
      - 'Domains.get'
      - 'Domains.listing'
      - 'SubDomains.get'
      - 'SubDomains.listing'
  selection_admin:
    cs-uri-query|contains:
      - 'customers_see_all'
      - 'api'
  condition: selection_method
level: medium
tags:
  - attack.t1552
  - cve.2026.100710

YARA Rule

rule CVE_2026_100710_Froxlor_DKIM_Key_Disclosure
{
    meta:
        description = "Detects Froxlor API responses leaking panel_domains dkim_privkey field"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100710"
        cve = "CVE-2026-100710"
        author = "Security Team"
        date = "2026-01-01"

    strings:
        $dkim_field = "dkim_privkey" ascii wide nocase
        $table_ref  = "panel_domains" ascii wide nocase
        $pem_priv   = "-----BEGIN PRIVATE KEY-----" ascii
        $pem_rsa    = "-----BEGIN RSA PRIVATE KEY-----" ascii
        $api1       = "Domains.listing" ascii wide nocase
        $api2       = "SubDomains.listing" ascii wide nocase

    condition:
        ($dkim_field or $table_ref) and ($pem_priv or $pem_rsa)
        or (any of ($api*)) and $dkim_field
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100710 Froxlor API DKIM private key disclosure attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"Domains.listing"; nocase; http.uri; content:"SubDomains.listing"; nocase; classtype:attempted-recon; reference:cve,2026-100710; sid:10071001; rev:1;)
alert http any any -> any any (msg:"CVE-2026-100710 Froxlor DKIM private key leaked in HTTP response"; flow:established,to_client; http.response_body; content:"dkim_privkey"; nocase; content:"BEGIN PRIVATE KEY"; distance:0; classtype:policy-violation; reference:cve,2026-100710; sid:10071002; rev:1;)

Elastic Detection

sequence by user.name with maxspan=10m
  [http where url.path : ("*Domains.listing*", "*Domains.get*", "*SubDomains.listing*", "*SubDomains.get*") and
   http.request.method == "GET"]
  [http where http.response.body : ("*dkim_privkey*", "*BEGIN PRIVATE KEY*")]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=nginx
| search uri_path="*Domains.listing*" OR uri_path="*Domains.get*" OR uri_path="*SubDomains.listing*" OR uri_path="*SubDomains.get*"
| stats count values(uri_path) as paths values(status) as status_codes earliest(_time) as first_seen latest(_time) as last_seen by src_ip, user
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="froxlor,web,cve_2026_100710,">
  <rule id="100710" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.(Domains|SubDomains)\.(get|listing)</field>
    <description>CVE-2026-100710: Froxlor API domain/subdomain listing accessed - potential DKIM private key disclosure</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>cve_2026_100710,information_disclosure,</group>
  </rule>
  <rule id="100711" level="12">
    <decoded_as>json</decoded_as>
    <field name="response_body">dkim_privkey</field>
    <description>CVE-2026-100710: Froxlor API response contains dkim_privkey field - DKIM private key leaked</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>cve_2026_100710,information_disclosure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict the customers_see_all delegated flag to the smallest possible set of trusted administrators, since the vulnerability is only reachable by an authenticated non-superadmin admin holding that flag. Limit network exposure of the Froxlor panel and its API to trusted management networks or VPN. Apply least privilege so that no operator holds broad cross-tenant visibility unless strictly required. Monitor API access to Domains.get, Domains.listing, SubDomains.get, and SubDomains.listing for anomalous or bulk invocations.

2. Patch / upgrade steps. Upgrade to Froxlor 2.3.12, in which the issue is fixed per the NVD description. Until the vendor confirmation path is verified through tracked sources (patch confidence remains 0/4 with no patch evidence in tracked data), verify the fix independently by confirming that the affected methods no longer return the panel_domains.dkim_privkey column. Because this CVE is a follow-on to an incomplete fix, ensure the 2.3.12 patch filters dkim_privkey and not just password and data_2fa.

3. Long-term hardening. Treat DKIM private keys and all cryptographic material as confidential assets requiring explicit allowlist-based response filtering, rather than enumerating sensitive columns in a denylist. Rotate DKIM signing keys for every domain whose key may have been observed by a non-superadmin account, then publish updated public keys in DNS. Enforce structured API response schemas that return only fields required by each endpoint. Adopt periodic access reviews for delegated cross-tenant permissions and log/alert on any API response containing key material.

References

• NVD — CVE-2026-100710: https://nvd.nist.gov/vuln/detail/CVE-2026-100710
• Froxlor project (upstream release notes / changelog for 2.3.12)
• CWE-200, Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1552, Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• CISA KEV — not listed (CVE-2026-100710 is not in the CISA Known Exploited Vulnerabilities catalog at time of writing)

No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence is currently available for CVE-2026-100710. No known threat actor campaigns have been associated with this CVE in the provided data.