CVE-2026-80198

Executive Summary

CVE-2026-80198 is a critical information disclosure vulnerability in the Kimai time-tracking application, affecting all versions prior to 2.56.0. The flaw resides in the template engine's failure to restrict the config() Twig function within sandboxed invoice and export templates, enabling authenticated administrators to retrieve arbitrary configuration keys — including LDAP bind passwords and SAML private keys. With a CVSS score of 7.5, the vulnerability can be exploited by an administrator to exfiltrate sensitive server-wide secrets into invoice or export documents that are subsequently accessible to lower-privileged users, creating a significant data breach vector. No public exploit, patch, or vendor mitigation is currently available.

Technical Analysis

Vulnerability Mechanism

The core flaw lies in the interaction between Kimai's template sandboxing and the Twig templating engine. Kimai allows administrators to create custom invoice and export templates to format generated documents. These templates are processed in a restricted ("sandboxed") Twig environment intended to limit access to sensitive functions and variables.

However, the config() Twig function — a custom extension that retrieves application configuration values — is not included in the sandbox blocklist. This oversight means that templates executed within the sandbox retain the ability to invoke config() with arbitrary configuration keys as arguments. Since the function directly queries the application's configuration repository without additional authorization checks beyond the sandbox policy, any administrator who can create or upload a template can obtain the value of any configuration parameter.

Attack Surface

The attack surface is compound:

• Attack vector: Network (AV:N) — the vulnerability is exploitable over HTTP.
• Privilege requirement: None specified (PR:N in CVSS vector), though the NVD description states the attacker must possess admin privileges to upload templates. This discrepancy likely reflects the CVSS scoring under the assumption that template upload is accessible without prior authentication in certain deployment configurations, or that the CVSS vector was scored against the downstream impact on lower-privileged users.
• User interaction: None (UI:N) — no victim interaction is required beyond the initial admin action of uploading a malicious template.
• Scope: Unchanged (S:U) — the vulnerability does not cross a trust boundary; all affected components reside within the same security authority.

Exploitation Mechanics

1. Template Upload: An attacker with administrator access creates a Twig template for invoices or exports containing expressions such as {{ config('security.ldap_bind_password') }} or {{ config('saml_private_key') }}.
2. Sandbox Bypass: When the template is rendered, the sandbox policy fails to block the config() function, allowing the template to read arbitrary keys from the application's configuration store.
3. Secret Exfiltration: The rendered invoice or export document embeds the retrieved secrets. Because these documents are designed to be shared with lower-privileged users (e.g., clients receiving invoices), the secrets are distributed beyond the administrator's own access level.

Root Cause Classification

The vulnerability is categorized as CWE-693 — Protection Mechanism Failure. The sandbox's protection mechanism is incomplete: it filters specific functions (e.g., system calls, file operations) but fails to include the config() accessor, leaving a gap through which protected data can be accessed.

Exploitation Scenarios

Note: No public PoC or exploit code is available. The attack chain below is inferred from the vulnerability class (sandbox bypass / template injection) and the NVD description. Function names and configuration key patterns are only used where explicitly mentioned in the description.

Scenario 1 — LDAP Credential Theft via Invoice Template

1. Reconnaissance: An attacker gains low-level access to a Kimai instance (e.g., a staff account). They identify that the application integrates with corporate LDAP for authentication (observable via login page behavior). They also recognize that an admin user exists (team lead) who has template editing rights.
2. Privilege Acquisition: The attacker socially engineers or coerces the admin into installing a "helpful" invoice template that the attacker provides (e.g., a modified timesheet invoice format).
3. Trigger: The admin uploads the template within the invoice template editor. When any user generates an invoice using this template, the config() function is invoked with keys relevant to LDAP configuration — extracting the bind password.
4. Exfiltration: The generated invoice PDF/HTML contains the LDAP bind password embedded in the document metadata or visible text. The attacker obtains the document — either because they are legitimately the recipient of an invoice (client role) or through later access to the document storage.
5. Post-Exploitation: The attacker uses the LDAP bind password to authenticate as a privileged directory service account, granting access to the entire corporate directory and potentially other systems that trust this credential.

Scenario 2 — SAML Private Key Exfiltration via Export Template

1. Reconnaissance: The attacker identifies that the Kimai instance uses SAML-based SSO (single sign-on), evident from the login redirect to an identity provider.
2. Template Manipulation: A compromised admin account modifies the default CSV export template to include {{ config('saml_private_key') }} and other sensitive keys.
3. Trigger: The attacker (still in a low-privilege user role) triggers an export of their own time records using the modified template. The config() call executes during rendering, embedding the SAML private key in the exported file.
4. Exfiltration: The export file is downloaded by the attacker.
5. Post-Exploitation: The attacker can now impersonate the application's SAML service provider, forge SAML assertions, and authenticate to any connected application that trusts the compromised private key.

Impact Assessment

CVSS Breakdown (derived from vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

• Confidentiality Impact: High — The vulnerability directly exposes sensitive configuration data including credentials and cryptographic keys.
• Integrity Impact: None — Configuration data is read, not modified.
• Availability Impact: None — The vulnerability does not affect system availability.
• Attack Complexity: Low — No special conditions or race conditions required.
• Privileges Required: None — CVSS scoring assumes no prior authentication, though the NVD description notes admin privileges are needed for template upload. This makes the effective risk potentially lower in practice but still severe.

Business Impact

• Credential Compromise: Leaked LDAP bind passwords and SAML private keys can be used to access the entire enterprise identity infrastructure. This can cascade into full domain compromise, lateral movement across connected systems, and persistent backdoor access.
• Regulatory Exposure: Organizations handling personal data (GDPR, CCPA) face reportable breach obligations if sensitive employee or client data is implicated.
• Reputational Damage: A breach exposing authentication secrets erodes trust in the organization's security posture.

Blast Radius

• Direct: All Kimai deployments running versions < 2.56.0.
• Extended: Any system relying on the compromised LDAP credentials or SAML private keys — including ERP systems, email platforms, VPN gateways, and cloud services federated via SAML.
• Latent: If the SAML private key is compromised, the attacker can forge assertions indefinitely until key rotation occurs — the window for abuse may extend well beyond initial detection.

Detection Guidance

The following detection rules target the exploitation patterns of CVE-2026-80198. Since this is a server-side template injection/sandbox bypass affecting document generation, the primary detection opportunities are:

1. Template content containing references to configuration keys.
2. Anomalous network traffic to/from the Kimai server.
3. Abnormal invoice/export generation patterns.

Sigma Rule

title: Kimai Config Function Usage in Invoice/Export Templates
id: 8b937475-1326-4a8b-b683-6f2d7d4e0b10
status: experimental
description: Detects creation or modification of Kimai invoice/export templates containing config() function calls - potential CVE-2026-80198 exploitation
author: Valtersit Threat Intelligence
date: 2026-01-15
logsource:
  category: application
  product: kimai
  service: web
detection:
  selection_template_write:
    event.action:
      - 'template_save'
      - 'template_update'
      - 'template_create'
    field: 'template_content'
  selection_config_call:
    field: 'template_content'
    contains:
      - "config("
      - "config ('"
      - "config('" 
  condition: selection_template_write AND selection_config_call
falsepositives:
  - Legitimate use of config() in custom templates by trusted admins (unlikely if sandbox is properly configured)
level: high
tags:
  - attack.t1190
  - cve.2026.80198

YARA Rule

rule Kimai_CVE_2026_80198_Config_Template_Exfil
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Kimai template files containing config() calls targeting sensitive configuration keys - CVE-2026-80198"
        date = "2026-01-15"
        cve = "CVE-2026-80198"
        severity = "high"
    strings:
        $config_call1 = /config\s*\(\s*['\"]/
        $ldap_key1 = /ldap/i
        $saml_key1 = /saml/i
        $secret_key1 = /secret|private|password|bind/i
        $template_ext1 = ".twig"
        $template_ext2 = "{%"
        $template_ext3 = "{{"
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or uint32(0) == 0x0A0D0A0D or
        ($config_call1 and ($ldap_key1 or $saml_key1 or $secret_key1)) and
        ($template_ext1 or $template_ext2 or $template_ext3)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"KIMAI CVE-2026-80198 - Template Upload with config() Call"; flow:established,to_server; http.request_line; content:"POST"; http.method; content:"template"; http.uri; nocase; content:"config"; http.request_body; depth:256; nocase; content:"ldap"; http.request_body; nocase; content:"saml"; http.request_body; nocase; flowbits:set,kimai_config_exfil; detection_filter:track by_src, count 5, seconds 60; classtype:attempted-admin; sid:2026801981; rev:1;)

Elastic Detection

sequence by host.name, user.name with maxspan=15m
  [any where event.action in ("template_save", "template_update", "template_create", "file_create") and
     process.args : ("*.twig", "*invoice*", "*export*") and
     process.args : "*config*" and
     process.args : ("*ldap*", "*saml*", "*secret*", "*password*")]
  [any where event.action in ("invoice_generate", "export_generate", "document_create") and
     process.args : ("*invoice*", "*export*")]

Splunk SPL Query

index=main sourcetype="kimai:web" 
  (event_type="template_save" OR event_type="template_update" OR event_type="template_upload")
  template_content="*config(*"
  | eval suspicious_template = if(match(template_content, "(?i)(ldap|saml|secret|password|bind)"), "YES", "NO")
  | where suspicious_template="YES"
  | rename user as acting_user, timestamp as event_time
  | stats count by acting_user, event_time, template_name, suspicious_template
  | sort - event_time

Wazuh OSSEC Rule

<group name="kimai,">
  <rule id="352958" level="14">
    <decoded_as>json</decoded_as>
    <field name="event_type">template_save|template_update|template_upload</field>
    <regex>config\s*\(|config\(</regex>
    <regex>(?i)(ldap|saml|secret|password|bind)</regex>
    <description>Kimai: Template containing config() call with sensitive key reference - CVE-2026-80198 exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_80198,template_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No vendor patch or official mitigation has been released for CVE-2026-80198 as of this report. The only remediation path is upgrading to Kimai version 2.56.0 or later when made available.

1. Immediate Mitigations (reactive)

2. Patch / Upgrade Steps

• Primary: Monitor the Kimai official security advisory channel (https://www.kimai.org) for the 2.56.0 release. When released, upgrade promptly.
• Backup: Before any version upgrade, take a full backup of the application database and configuration files.
• Verification: After upgrading, confirm that the sandbox policy explicitly blocks config() and that all custom templates from before the upgrade are reviewed and re-approved.

3. Long-Term Hardening

• Sandbox completeness: Ensure the Twig sandbox policy denies all custom functions not explicitly whitelisted. Conduct regular security testing of template functionality.
• Least privilege: Enforce the principle of least privilege for template editing. Consider requiring two-person rule for template changes.
• Configuration secret management: Migrate LDAP passwords, SAML private keys, and other secrets to a dedicated secrets management solution (e.g., HashiCorp Vault). This limits exposure even if configuration keys are queried.
• Monitoring: Implement continuous detection for anomalous template activity as described in the detection guidance above.
• Incident response readiness: Prepare response playbooks for template injection and credential exposure events.

References

1. NVD Entry for CVE-2026-80198 — https://nvd.nist.gov/vuln/detail/CVE-2026-80198 (contains the full NVD description and CVSS scoring used in this report)
2. Kimai Official Website / Security Advisories — https://www.kimai.org (monitor for 2.56.0 release notes and any vendor advisory; no advisory published as of this report)
3. Kimai Repository — https://github.com/kimai/kimai (watch for release tags and changelog entries referencing the sandbox fix)
4. MITRE ATT&CK T1190 — https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application — relevant for the template injection attack chain)
5. CWE-693 Reference — https://cwe.mitre.org/data/definitions/693.html (Protection Mechanism Failure — root cause classification)

Campaign Information: No in-the-wild exploitation, CISA KEV listing, or known threat actor campaigns have been reported as of this report date. The vulnerability rests in an unpatched state, increasing the likelihood of eventual weaponization.