Live › vulnerability › CVE-2026-119648
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 has a missing authorization check on the host search endpoint POST /api/v3/hosts/search/asstdetail. A logged-in user can read host attributes and topology details belonging to other businesses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Exposure requires a running bk-cmdb instance through version 3.14.6 with multiple businesses configured and at least one authenticated user who should not see every business. Single-business deployments or instances where all users are trusted are less exposed. The sources do not state a fixed version.
No product ranges from the sources yet.
3.14.6/api/v3/hosts/search/asstdetail is reachable by non-admin users on your instance/api/v3/hosts/search/asstdetail with business filters you do not expectNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.
This page as .md · .json · in your agent: get_signal("CVE-2026-119648")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.