Live › vulnerability › CVE-2026-119599
AxonHub through 1.0.0-beta11 does not check that the scopes on a service_account API key are ones the creator holds. A project user with write_api_keys can mint a key with system-level read_channels and use it on /admin/graphql to read every channel's configuration across all projects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Teams running AxonHub through 1.0.0-beta11 where project users can hold the write_api_keys scope. The exposure comes from unvalidated scopes on service_account keys, so deployments that restrict key creation to admins are less exposed. The sources do not say which configurations are safe beyond that.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AxonHub | github | <= 1.0.0-beta11 | – |
v1.0.0-beta11 once publishedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.
This page as .md · .json · in your agent: get_signal("CVE-2026-119599")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.