{"id":"CVE-2026-119599","kind":"vulnerability","aliases":["CVE-2026-119599"],"related":[],"title":"AxonHub: project users can mint system-level API keys and read channel configs","description":"AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.","summary":"AxonHub through 1.0.0-beta11 does not check that the scopes on a service_account API key are ones the creator holds. A project user with write_api_keys can mint a key with system-level read_channels and use it on /admin/graphql to read every channel's configuration across all projects.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AxonHub","fixed":[],"affected":"<= 1.0.0-beta11","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","axonhub","llm-gateway","multi-tenant","privilege-escalation","self-hosted"],"not_affected_if":["admin-only-key-creation","no-project-users","no-service-account-keys","single-user"],"how_to_check":"- Run AxonHub <= 1.0.0-beta11 (check the version in the admin UI or your image tag)? You are affected.\n- List users/roles with project-level write_api_keys who lack system read_channels.\n- Audit existing service_account API keys for system-level scopes (read_channels, write_channels) created by project users.","fix":"No fixed release confirmed. Upstream fix is commit e5c904efbdabd80d74827dfae478330339c5a514 (PR #2741) per VulnCheck; run a build containing it or the first release after v1.0.0-beta11 once published. Until then, limit who holds write_api_keys.","status":"open","published_at":"2026-10-30T14:16:48+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","triaged_at":"2026-10-30T14:32:54+00:00","updated_at":"2026-10-30T14:34:49+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-30T14:32:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"AxonHub: project users can mint system-level API keys and read channel configs","impact":"medium","summary":"AxonHub through 1.0.0-beta11 lets project users create service account API keys with unvalidated scopes, so they can grant themselves system-level permissions. An attacker holding the write_api_keys scope can mint a key with read_channels and query the admin GraphQL endpoint to read every channel's configuration, including base URLs and model lists.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["axonhub","llm-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads all channel configs, including base URLs and model lists","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry in the sources does not state one.","how_to_check":"- Check the AxonHub version in use against `1.0.0-beta11`; the flaw is listed as affecting versions through that release.\n- Review which accounts hold the `write_api_keys` scope and whether project users can create service_account API keys.\n- unknown for anything beyond this in the sources.","plain_action":"","needs_analyst":true,"not_affected_if":["admin-only-key-creation"],"who_is_affected":"Teams running AxonHub through 1.0.0-beta11 where project users can hold the write_api_keys scope. The exposure comes from unvalidated scopes on service_account keys, so deployments that restrict key creation to admins are less exposed. The sources do not say which configurations are safe beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4143,"output_tokens":599,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry in the sources does not state one.","search":"'-119599':17A,20A '-2026':16A,19A '/admin/graphql':80B,131C '1.0.0':40B,92C 'account':51B,112C 'across':87B 'ai':23B 'ai-tool':22B 'allow':100C 'api':9A,52B,64B,113C,121C 'assign':104C 'attack':118C 'axonhub':1A,21A,25B,38B,90C 'base':139C 'beta11':41B,93C 'channel':13A,75B,84B,128C,135C 'check':44B 'config':14A 'configur':86B,137C 'contain':94C 'creat':110C 'creator':57B 'cve':15A,18A 'escal':34B,97C 'everi':83B,134C 'gateway':28B 'hold':58B,119C 'host':37B 'includ':138C 'key':10A,53B,65B,69B,114C,122C,125C 'level':8A,73B,107C 'list':143C 'llm':27B 'llm-gateway':26B 'mint':5A,67B,124C 'model':142C 'multi':30B 'multi-ten':29B 'one':55B 'privileg':33B,96C 'privilege-escal':32B 'project':2A,60B,89B,101C 'queri':130C 'read':12A,74B,82B,127C,133C 'scope':47B,108C,117C 'self':36B 'self-host':35B 'servic':50B,111C 'system':7A,72B,106C 'system-level':6A,71B,105C 'tenant':31B 'tool':24B 'unvalid':116C 'url':140C 'use':77B 'user':3A,61B,102C 'vulner':98C 'write':63B,120C","nicknames":[],"mitigations":[],"who_affected":"Teams running AxonHub through 1.0.0-beta11 where project users can hold the write_api_keys scope. The exposure comes from unvalidated scopes on service_account keys, so deployments that restrict key creation to admins are less exposed. The sources do not say which configurations are safe beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T14:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-119599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119599","severity":null,"published_at":"2026-10-30T14:16:48+00:00","modified_at":"2026-10-30T14:16:48+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","fetched_at":"2026-10-30T14:30:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119599:1161","url":null,"severity":null,"published_at":"2026-10-30T14:34:49+00:00","modified_at":"2026-10-30T14:34:49+00:00","first_seen_at":"2026-10-30T14:34:49+00:00","fetched_at":"2026-10-30T14:34:49+00:00","note":"Root cause confirmed from reporter write-up (CreateAPIKey/UpdateAPIKey skip CanGrantScopes for service_account keys; api_key.go L338/L446). VulnCheck cites fix commit e5c904e / PR #2741 on looplj/axonhub, but I could not read the PR/commit (pages empty) and releases page shows no release after v1.0.0-beta11 (2026-10-08), so no fixed release is confirmed. Not exploited; PoC steps are in the write-up (marked illustrative, not run). Nothing verified: no maintainer advisory read."}],"documents":[{"id":23986,"url":"https://hackmd.io/@hieuPenguinnn/axonhub-apikey-scope-grant-privilege-escalation","title":"AxonHub privilege escalation: service_account API keys minted with scopes the creator does not hold (reporter write-up)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":23987,"url":"https://www.vulncheck.com/advisories/axonhub-through-1.0.0-beta11-privilege-escalation-via-service-account-api-key-scopes","title":"VulnCheck: AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":23988,"url":"https://github.com/looplj/axonhub/releases","title":"looplj/axonhub releases (latest seen: v1.0.0-beta11, 2026-10-08)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}