---
title: "CVE-2026-31278: Suprema BioStar - Information Disclosure"
description: "Suprema BioStar 2 < 2.9.12 and BioStar X < 1.0.2 contain an information disclosure vulnerability caused by improper protection of Active Directory service account credentials in /api/v2/setting/adserversetting endpoint, letting attackers obtain credentials in cleartext via crafted GET request, exploit requires network access."
url: https://panop.io/threat-heartbeat/CVE-2026-31278/
---

# CVE-2026-31278 Suprema BioStar - Information Disclosure

Suprema BioStar 2 < 2.9.12 and BioStar X < 1.0.2 contain an information disclosure vulnerability caused by improper protection of Active Directory service account credentials in /api/v2/setting/adserversetting endpoint, letting attackers obtain credentials in cleartext via crafted GET request, exploit requires network access.

CVSS base score 7.7 /10

High

CISA KEV

Not listed

Public exploit

Proof of concept available

Authentication

Required

EPSS

0.28% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-31278)

## Details

Type

Information Disclosure

Impact

Information Disclosure

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Published

14 September 2026

Updated

15 October 2026

Weakness

[CWE-319](https://cwe.mitre.org/data/definitions/319.html)

## Vendor fix

Upgrade to BioStar 2 version 2.9.12 or later and BioStar X version 1.0.2 or later.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-31278](https://nvd.nist.gov/vuln/detail/CVE-2026-31278)
- [https://github.com/mda1r/biostar2-ad-credential-exposure](https://github.com/mda1r/biostar2-ad-credential-exposure)
- [https://www.supremainc.com](https://www.supremainc.com/)
- [https://github.com/mda1r/CVE-2026-31278](https://github.com/mda1r/CVE-2026-31278)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)