Emlog Pro versions through 2.6.23 contain a hard‑coded disabling of TLS certificate verification in ai.php, allowing an attacker on a network adjacent to the host to intercept outgoing HTTPS calls to configured LLM providers. By presenting arbitrary certificates the attacker can perform a man‑in‑the‑middle attack and capture the Authorization Bearer API keys that the application sends in every request. The intercepted payload can then be crafted to trigger the tool‑call execution pipeline, specifically the query_database and update_config handlers, giving the attacker the ability to execute arbitrary database queries or modify system configuration.

The vulnerability affects the emlog product from the vendor emlog, specifically all released versions up to and including 2.6.23.

The CVSS score is 9.1, indicating critical severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit relies on the victim host actively sending LLM requests over HTTPS; a network‑adjacent attacker can observe and replace the TLS handshake. Because the API keys are transmitted in clear text once intercepted, exploitation is likely to succeed in any production environment that relies on these LLM integrations.