kb: security
kb: ai-created
kb: ai-edited
Situation
The Plesk GoAccess statistics integration in Plesk Obsidian for Linux allows cross-subscription information disclosure. This security vulnerability has been identified as CVE-2026-82977.
Affected product version
| Product | Affected versions | Patched versions |
|---|---|---|
| Plesk for Linux | 18.0.77 - 18.0.81.7 18.0.82 - 18.0.82.2 |
18.0.81.8 18.0.82.3 |
| Plesk for Windows | Not affected | Not applicable |
Impact
Information disclosure is possible. The exposed web statistics data can include requested URLs with any tokens or other values they contain, visitor IP addresses, and referring pages.
Call to action
- Update Plesk Obsidian to 18.0.81.8, 18.0.82.3, or any later version: How to update Plesk Obsidian to the latest build
- Rotate secrets or tokens if they could have been exposed in request URLs to your customers' domains.
How to confirm the patched version is installed
Check the installed version as described in How to find version of Plesk installed on server? and make sure it is 18.0.81.8, 18.0.82.3, or later.
Acknowledgement
We would like to thank Ady Elouej for responsibly disclosing this vulnerability and working with us to help protect our customers.
Comments
Please sign in to leave a comment.