Vulnerability Description
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/looplj/axonhub
- https://github.com/looplj/axonhub/blob/v1.0.0-beta11/internal/server/biz/api_key
- https://github.com/looplj/axonhub/blob/v1.0.0-beta11/internal/server/biz/api_key
- https://github.com/looplj/axonhub/commit/e5c904efbdabd80d74827dfae478330339c5a51
- https://github.com/looplj/axonhub/issues/2724
- https://github.com/looplj/axonhub/pull/2741
- https://hackmd.io/@hieuPenguinnn/axonhub-apikey-scope-grant-privilege-escalation
- https://www.vulncheck.com/advisories/axonhub-through-1.0.0-beta11-privilege-esca
- https://hackmd.io/@hieuPenguinnn/axonhub-apikey-scope-grant-privilege-escalation
FAQ
What is CVE-2026-119599?
CVE-2026-119599 is a vulnerability with a CVSS score of 4.3 (MEDIUM). AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attacke...
How severe is CVE-2026-119599?
CVE-2026-119599 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119599?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.