SearchSubscribe

TRA-2026-36

Information disclosure in backup agent diagnostic endpoint

An unauthenticated diagnostics route returns configured job names, paths and storage targets.

  • Patched
  • Enterprise software

CVSS 3.1 base score

5.3medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vendor
Larkspur Software
Product
Larkspur Backup Agent
CVE
  • CVE-2026-34407
Disclosure
85 days
Researchers
Amira Haddad

Score breakdown

Exploitability

Attack vector
Attack complexity
Privileges required
User interaction

Scope

Scope

Impact

Confidentiality
Integrity
Availability

Affected products

ProductAffectedFixed in
Larkspur Backup Agent8.1 – 8.48.4.1

Questions about this advisory

research@tenable.com
On this page6 sections
  1. Score breakdown
  2. Affected products
  3. Synopsis
  4. Proof of concept
  5. Solution
  6. Disclosure timeline

Synopsis

An unauthenticated diagnostics route returns configured job names, paths and storage targets.

Proof of concept

Tenable has shared a proof of concept with Larkspur Software. It is not published here, to give operators time to apply the fix.

Solution

Upgrade to 8.4.1 or later. The diagnostics route now requires the agent’s management token.

Disclosure timeline

  1. Tenable reports the issue to Larkspur Software

  2. TRA-2026-36 published

85 days from report to publication, against a 90-day policy.How we disclose