{"id":"CVE-2026-125751","kind":"vulnerability","aliases":["CVE-2026-125751"],"related":[],"title":"Meteroid: API token lookup leaks other tenants' secret hashes","description":"Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash and owning tenant ID.","summary":"Meteroid before 2.2.0 has a gRPC handler, GetApiTokenById, that does not check the caller's tenant. A signed-in user with settings:read permission can request another tenant's API token ID and receive that token's Argon2 secret hash and owning tenant ID.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grpc","meteroid","multi-tenant","other","self-hosted"],"not_affected_if":["single-tenant-trusted-users","version-2.2.0-or-later"],"how_to_check":"- Check the Meteroid version you run; the sources say versions before `2.2.0` are affected.","fix":"- Move to Meteroid `2.2.0` or later.","status":"open","published_at":"2026-11-10T16:17:21+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","triaged_at":"2026-11-10T16:23:45+00:00","updated_at":"2026-11-10T16:23:45+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T16:23:45Z","model":"claude-haiku-5-5","output":{"fix":"- Move to Meteroid `2.2.0` or later.","reach":"network","title":"Meteroid: API token lookup leaks other tenants' secret hashes","impact":"medium","summary":"Meteroid before 2.2.0 has a gRPC handler, GetApiTokenById, that does not check the caller's tenant. A signed-in user with settings:read permission can request another tenant's API token ID and receive that token's Argon2 secret hash and owning tenant ID.","audience":"businesses","category":"other","nicknames":[],"who_cares":["meteroid","self-hosted","multi-tenant","grpc"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads another tenant's API token hash and tenant ID","analyst_note":"","how_to_check":"- Check the Meteroid version you run; the sources say versions before `2.2.0` are affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2.2.0-or-later","single-tenant-trusted-users"],"who_is_affected":"Teams that self-host Meteroid or run it for multiple tenants, where users with settings:read permission share the instance. The flaw needs an authenticated account, so single-tenant deployments with only trusted users are lower risk. unknown whether the sources list other conditions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000722,"input_tokens":4625,"output_tokens":519,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-125751':12A,15A '-2026':11A,14A '2.2.0':27B,72C 'anoth':52B,101C 'api':2A,55B,104C 'apitokensservic':80C 'appli':87C 'argon2':63B,110C 'authent':93C 'author':75C 'bypass':76C 'caller':38B,89C 'check':36B 'contain':73C 'context':92C 'cve':10A,13A 'fail':85C 'getapitokenbyid':32B,81C 'grpc':16B,30B,82C 'handler':31B,83C 'hash':9A,65B,112C 'host':24B 'id':57B,69B,106C,116C 'leak':5A 'lookup':4A 'meteroid':1A,17B,25B,70C 'multi':19B 'multi-ten':18B 'obtain':108C 'own':67B,114C 'permiss':49B,98C 'read':48B,97C 'receiv':59B 'request':51B 'secret':8A,64B,111C 'self':23B 'self-host':22B 'set':47B,96C 'sign':43B 'signed-in':42B 'suppli':100C 'tenant':7A,20B,40B,53B,68B,91C,102C,115C 'token':3A,56B,61B,105C 'user':45B,94C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Meteroid or run it for multiple tenants, where users with settings:read permission share the instance. The flaw needs an authenticated account, so single-tenant deployments with only trusted users are lower risk. unknown whether the sources list other conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["grpc","low","meteroid","multitenant","other","selfhosted"],"campaign_type":null,"search_a":"'-125751':12A,15A '-2026':11A,14A 'api':2A 'cve':10A,13A 'hash':9A 'leak':5A 'lookup':4A 'meteroid':1A 'secret':8A 'tenant':7A 'token':3A","search_b":"'2.2.0':27B 'anoth':52B 'api':55B 'argon2':63B 'caller':38B 'check':36B 'getapitokenbyid':32B 'grpc':16B,30B 'handler':31B 'hash':65B 'host':24B 'id':57B,69B 'meteroid':17B,25B 'multi':19B 'multi-ten':18B 'own':67B 'permiss':49B 'read':48B 'receiv':59B 'request':51B 'secret':64B 'self':23B 'self-host':22B 'set':47B 'sign':43B 'signed-in':42B 'tenant':20B,40B,53B,68B 'token':56B,61B 'user':45B","search_c":"'2.2.0':72C 'anoth':101C 'api':104C 'apitokensservic':80C 'appli':87C 'argon2':110C 'authent':93C 'author':75C 'bypass':76C 'caller':89C 'contain':73C 'context':92C 'fail':85C 'getapitokenbyid':81C 'grpc':82C 'handler':83C 'hash':112C 'id':106C,116C 'meteroid':70C 'obtain':108C 'own':114C 'permiss':98C 'read':97C 'secret':111C 'set':96C 'suppli':100C 'tenant':91C,102C,115C 'token':105C 'user':94C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125751","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125751","severity":null,"published_at":"2026-11-10T16:17:21+00:00","modified_at":"2026-11-10T16:17:21+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","fetched_at":"2026-11-10T16:22:34+00:00","note":null}],"documents":[{"id":116115,"url":"https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2bc72b277c5329e20eba384b8653805f2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116116,"url":"https://github.com/meteroid-oss/meteroid/releases/tag/v2.2.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116117,"url":"https://www.vulncheck.com/advisories/meteroid-before-2.2.0-cross-tenant-api-token-hash-disclosure-via-getapitokenbyid","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}