drEryk Gabinet hardcoded API creds flaw fixed

10 September 2026 routine vulnerability healthcare

DrEryk Gabinet medical software before v11.5.0 has hard-coded API credentials letting attackers read/modify support tickets.

CERT Polska coordinated disclosure of CVE-2026-17038, a vulnerability in drEryk Gabinet software affecting versions prior to 11.5.0. The flaw stems from hard-coded API credentials embedded in the application's ticket reporting component. These static credentials can be extracted and used to authenticate directly against the ticket system's API, bypassing normal application-level access controls.

An attacker exploiting this flaw could perform privileged operations beyond the scope intended for end users, including reading and modifying support tickets, which may contain sensitive information depending on the deployment context. There is no indication in the advisory of active exploitation in the wild; this appears to be a responsibly disclosed finding credited to researcher Wojciech Giełda. Defenders using drEryk Gabinet should upgrade to version 11.5.0 or later, which presumably removes or rotates the hard-coded credentials, and review ticket system logs for anomalous API access originating outside expected application flows.

Given the healthcare-oriented nature of the drEryk Gabinet product line (commonly used for medical practice management in Poland), organizations should prioritize patching to prevent unauthorized disclosure or tampering of support ticket data, which could include patient or operational information.

Mentioned in this report

Vulnerabilities CVE-2026-17038

Detection guidance

drEryk Gabinet API Access with Hardcoded Credentials

ATT&CK T1552.001

Detects HTTP/HTTPS requests to drEryk Gabinet ticket system API endpoints using authentication patterns consistent with hardcoded credential extraction. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: drEryk Gabinet API Access with Hardcoded Credentials
description: Detects network traffic to drEryk Gabinet ticket system API endpoints
  using static authentication credentials. This rule identifies potential exploitation
  of CVE-2026-17038 where embedded API credentials are extracted and used to bypass
  application-level access controls.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_api_endpoint:
    DestinationHostname|contains:
    - dreryk
    - gabinet
    DestinationPort:
    - 443
    - 80
    CommandLine|contains:
    - /api/
    - /ticket
  selection_auth_header:
    CommandLine|contains:
    - Authorization
    - X-API-Key
    - api_key
  filter_legitimate_application:
    Image|endswith:
    - \drEryk.exe
    - \gabinet.exe
  condition: (selection_api_endpoint and selection_auth_header) and not filter_legitimate_application
falsepositives:
- Legitimate drEryk Gabinet client application communicating with API
- Authorized administrative tools querying the ticket system API
level: high
id: d261c4b1-bbf6-5f29-8438-3db38a6dbe8d
status: experimental
author: Vorant

Extraction of drEryk Gabinet Application Configuration Files

ATT&CK T1552.001

Detects file access or exfiltration of drEryk Gabinet configuration or credential files where hardcoded API credentials may be stored. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Extraction of drEryk Gabinet Application Configuration Files
description: Detects file read, copy, or exfiltration of drEryk Gabinet configuration
  directories and files that may contain hardcoded API credentials or authentication
  tokens used to exploit CVE-2026-17038.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_dreryk_config:
    TargetFilename|contains:
    - dreryk
    - gabinet
    TargetFilename|endswith:
    - .config
    - .xml
    - .ini
    - .json
    - credentials
  selection_suspicious_access:
    EventType:
    - CreateKey
    - ReadFile
    - CopyFile
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \7z.exe
    - \winrar.exe
    - \curl.exe
  filter_legitimate_admin:
    User|contains:
    - SYSTEM
    - LOCAL SERVICE
  condition: (selection_dreryk_config and selection_suspicious_access) and not filter_legitimate_admin
falsepositives:
- Legitimate system backups or configuration exports by IT administrators
- Software update or repair processes accessing application configuration
level: medium
id: 61ba832e-cab7-5755-b5af-c7978d41a248
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/09/CVE-2026-17038

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free