CWEweakness
CWE-1188 Initialization of a Resource with an Insecure Default
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
Common consequences
• Other: Varies by Context — The impact of insecure defaults varies widely
depending on the functionality that the product
controls.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2022-36349: insecure default variable initialization in BIOS firmware for a hardware board allows DoS
• CVE-2022-42467: A generic database browser interface has a default mode that exposes a web server to the network, allowing queries to the database.
Related
Attack pattern · CAPEC (1)
- CAPEC-665 Exploitation of Thunderbolt Protection Flaws attack pattern
Observed example · CVE (2)
- CVE-2022-36349 Insecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may… vulnerability
- CVE-2022-42467 When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the… vulnerability
Child of · CWE (3)
Referenced by not in database · weakness (1)
Referenced by CAPEC · weakness (1)
- CAPEC-665 Exploitation of Thunderbolt Protection Flaws attack pattern
Referenced by CVE · weakness (381)
- CVE-2026-112255 Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. vulnerability
- CVE-2026-110952 A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature,… vulnerability
- CVE-2026-116273 MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. vulnerability
- CVE-2026-118691 xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows… vulnerability
- CVE-2026-116672 Authlib is a Python library which builds OAuth and OpenID Connect servers. vulnerability
- CVE-2026-25784 Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! vulnerability
- CVE-2026-114618 Authlib is a Python library which builds OAuth and OpenID Connect servers. vulnerability
- CVE-2026-114123 D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. vulnerability
- CVE-2026-114397 Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting… vulnerability
- CVE-2026-111764 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. vulnerability
- CVE-2026-77934 Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow… vulnerability
- CVE-2026-77936 Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API… vulnerability
- CVE-2026-103091 Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy… vulnerability
- CVE-2026-109437 Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to… vulnerability
- CVE-2026-110631 Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to… vulnerability
- CVE-2026-110769 holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform… vulnerability
- CVE-2026-14765 Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node… vulnerability
- CVE-2026-77427 FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. vulnerability
- CVE-2026-53709 MCP Context Forge is an MCP gateway and administrative platform. vulnerability
- CVE-2026-89105 The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient… vulnerability
- CVE-2026-89120 A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. vulnerability
- CVE-2026-109569 sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem… vulnerability
- CVE-2026-78013 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure… vulnerability
- CVE-2026-78018 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure… vulnerability
- CVE-2026-104077 Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes… vulnerability
- CVE-2026-104078 Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to… vulnerability
- CVE-2026-33586 Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail… vulnerability
- CVE-2026-76276 In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk… vulnerability
- CVE-2026-105744 Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. vulnerability
- CVE-2026-103956 Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain… vulnerability
Referenced by CWE · child of (1)
- CWE-453 Insecure Default Variable Initialization weakness