What is CVE-2026-71238?

CVE-2026-71238 is a critical-severity vulnerability in Djangocrm Django-crm, classified under Use of Hard-coded Credentials. CVSS score: 9.1/10. Published 2026-08-05.

How severe is CVE-2026-71238?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Djangocrm Django-crm

CVE-2026-71238

DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens…

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Djangocrm Django-crm — versions 0

Weakness classification (CWE)

CWE-798 — Use of Hard-coded Credentials

References

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Frequently asked questions

What is CVE-2026-71238?: CVE-2026-71238 is a critical-severity vulnerability in Djangocrm Django-crm, classified under Use of Hard-coded Credentials. CVSS score: 9.1/10. Published 2026-08-05.
How severe is CVE-2026-71238?: Critical severity. CVSS v3 base score is 9.1 out of 10.