High severity · published Oct 20, 2026
CVE-2026-113459
Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ET
Extension "TYPO3 AI Integration Extension" · TYPO3
before 14.0.2 · source: vendor
Affected product
ET
Extension "TYPO3 AI Integration Extension"
TYPO3
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113459
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113459
typo3.org
https://typo3.org/security/advisory/typo3-ext-sa-2026-035
More from Extension "TYPO3 AI Integration Extension"
7.2
CVE-2026-112239
Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)