AIKIDO-2026-10132

TL;DR

Affected versions of this package are vulnerable to Unauthenticated Access to Sensitive Configuration via /v1/plan API, where the /v1/plan endpoint was accessible without admin privileges, allowing non-admin users to retrieve application plans that may include environment variables containing secrets, credentials, or tokens; an attacker with basic access to Pebble could exploit this by querying the endpoint to harvest sensitive configuration data, pivot to other systems using leaked credentials, escalate privileges, or facilitate further compromise without requiring direct code execution or elevated permissions.