CVE-2026-90510: dromara orion-visor Key Management Errors

Vulnerability summary

CVE-2026-90510 is a high (CVSS 8.3) Key Management Errors vulnerability in dromara orion-visor. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-09-2026
   PublishedVulnerability first disclosed.
2. 14-09-2026
   Last modifiedVulnerability information updated.

Description

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-320Key Management ErrorsWeaknesses in this category are related to errors in the management of cryptographic keys.
• CWE-321Use of Hard-coded Cryptographic KeyThe product uses a hard-coded, unchangeable cryptographic key.