---
id: "CVE-2026-124574"
page: "https://infrastack.ai/live/CVE-2026-124574"
kind: "vulnerability"
aliases: ["CVE-2026-124574"]
title: "grok2api: video job retry flaw allows improper authorization remotely"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "grok", "grok2api", "llm-gateway", "self-hosted"]
not_affected_if: ["version-3.1.7-or-later"]
published_at: "2026-11-09T07:17:32+00:00"
first_seen_at: "2026-11-09T07:25:05+00:00"
updated_at: "2026-11-09T07:25:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124574", "first_seen_at": "2026-11-09T07:25:05+00:00"}]
exploit_sources: []
---

# grok2api: video job retry flaw allows improper authorization remotely

Link for people: https://infrastack.ai/live/CVE-2026-124574 (this .md is for agents)

grok2api is a gateway that lets applications call Grok models through an API. A flaw in its video job retry handler lets a remote attacker get past an authorization check, and the public exploit may be used.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the deployed grok2api version; versions up to `3.1.6` are affected.
- Look for the file `backend/internal/application/gateway/video.go` in your deployed source and confirm it matches the fixed release.

## Fix

- grok2api: upgrade to `3.1.7` (fix patch `199b3abecc14907176dae1f1cacf125419caa94d`).

## Timeline

- 2026-11-09T07:25:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124574

## Documents

- [fix] Patch: github.com https://github.com/chenyme/grok2api/commit/199b3abecc14907176dae1f1cacf125419caa94d
- [fix] Release notes: github.com https://github.com/chenyme/grok2api/releases/tag/v3.1.7

## From the sources

A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_