Hard-coded Cryptographic Key Vulnerability in Orion-visor

Dromara orion-visor, an asset management platform, is vulnerable to a security flaw identified as CVE-2026-90510. The vulnerability stems from the use of a hard-coded cryptographic key within the HostKeyServiceImpl.encryptKey function, located in the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java.

Because the key is hard-coded into the source code, encryption for host keys is predictable, undermining the confidentiality of stored credentials. Attackers can leverage this fixed key to decrypt sensitive host keys remotely. The vulnerability was disclosed publicly following a failure by the project maintainers to address an early issue report. As of the current disclosure, no patch is available. Defenders should note that this vulnerability exposes the underlying infrastructure managed by orion-visor to significant risk, as the compromise of host keys often leads to unauthorized access to downstream systems.

Impact

Successful exploitation allows remote attackers to compromise host key encryption, leading to the exposure of credentials used for remote server access. This could facilitate lateral movement, further unauthorized access to managed assets, and potential full system compromise for all hosts integrated with the affected orion-visor instance.

Recommendation

Prioritize the identification and isolation of internet-facing orion-visor instances. Since no vendor patch exists, consider restricting access to the web interface to authorized management subnets only until a fix is released. Audit existing host key configurations for signs of unauthorized access or modification.