What happened
NVD published CVE-2026-67598 (CVSS 7.4) on 2026-08-03, describing a blog platform (Emlog Pro) that disables TLS certificate verification specifically for its AI/LLM integration service, enabling network-adjacent MITM interception of API keys and LLM responses.
Why it matters
While Emlog Pro is a niche PHP blogging platform, the flaw specifically undermines the confidentiality/integrity of its AI feature's traffic to LLM providers, exposing API credentials and conversation content to network-level attackers — a narrow but concrete AI-specific exposure.
Attack vector
include/service/ai.php disables CURLOPT_SSL_VERIFYPEER and related TLS verification options when making outbound HTTPS requests to configured LLM providers, allowing a network-adjacent attacker to intercept and manipulate the traffic via a machine-in-the-middle attack with an arbitrary certificate.
Affected systems
Emlog Pro through 2.6.23
Mitigation
Apply the upstream fix restoring TLS certificate validation for outbound LLM API requests (GHSA-hf85-99vj-m4c5).