---
id: "CVE-2026-119648"
kind: "vulnerability"
aliases: ["CVE-2026-119648"]
title: "Tencent BlueKing CMDB: authenticated users can view other businesses' hosts"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bk-cmdb", "package", "self-hosted", "tencent-blueking"]
not_affected_if: ["no-untrusted-authenticated-users", "single-business-deployment"]
published_at: "2026-10-30T15:16:48+00:00"
first_seen_at: "2026-10-30T15:31:10+00:00"
updated_at: "2026-10-30T15:33:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119648", "first_seen_at": "2026-10-30T15:31:10+00:00"}]
---

# Tencent BlueKing CMDB: authenticated users can view other businesses' hosts

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 has a missing authorization check on the host search endpoint POST /api/v3/hosts/search/asstdetail. A logged-in user can read host attributes and topology details belonging to other businesses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look at the installed bk-cmdb version and compare it with `3.14.6`
- Check whether the route `/api/v3/hosts/search/asstdetail` is reachable by non-admin users on your instance
- Review access logs for POST requests to `/api/v3/hosts/search/asstdetail` with business filters you do not expect

## Timeline

- 2026-10-30T15:31:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119648

## From the sources

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_