{"id":"CVE-2026-68905","kind":"vulnerability","aliases":["CVE-2026-68905"],"related":[],"title":"Hugo Blog: unauthenticated AI proxy spends the operator's LLM API key","description":"Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints (POST /api/blog-assistant, POST /api/blog-search-embedding, POST /api/blog-search-rerank) without any authentication check. When deployed following the documented Nginx reverse-proxy setup, any unauthenticated remote attacker can send arbitrary requests that the proxy forwards to the upstream LLM/embedding/rerank API using the operator's server-side API key (OPENAI_API_KEY / AI_SEARCH_API_KEY). This enables unlimited quota consumption, cost exhaustion, and potential service unavailability for the operator. At time of publication, there are no publicly available patches.","summary":"Hugo Blog's AI assistant proxy exposes three endpoints with no authentication check. Any remote visitor can send arbitrary requests that the server forwards to the upstream LLM, embedding and rerank APIs using the operator's own API key.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hugo_blog","fixed":[],"affected":"commit 744ca15 and earlier","ecosystem":"github"}],"ecosystems":[],"tags":["hugo-blog","llm-api-key","nginx","package","self-hosted"],"not_affected_if":["ai-proxy-not-running","auth-required","default-config","endpoints-blocked-at-proxy"],"how_to_check":"- Check the deployed copy's server/ai-assistant-proxy.mjs: the route gate near line 249 checks only method and path, with no auth.\n- Check whether your Nginx config exposes /api/* publicly (as in docs/ai-assistant-nginx.example.conf) and whether POST /api/blog-assistant, /api/blog-search-embedding or /api/blog-search-rerank answers without credentials.\n- Check whether OPENAI_API_KEY or AI_SEARCH_API_KEY is set for the proxy, and whether ALLOWED_ORIGIN is unset (defaults to *).\n- Check the deployed commit: 744ca15 or earlier is affected; no later fixed commit is named.","fix":"No fixed version: the advisory lists patched versions as None. Until a patch exists, block /api/blog-assistant, /api/blog-search-embedding and /api/blog-search-rerank at the proxy or require auth, set ALLOWED_ORIGIN to your own origin, and set spend limits on the upstream key.","status":"open","published_at":"2026-11-13T20:19:00+00:00","first_seen_at":"2026-11-13T21:27:24+00:00","triaged_at":"2026-11-13T21:29:33+00:00","updated_at":"2026-11-13T21:30:10+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-13T21:29:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Hugo Blog: unauthenticated AI proxy spends the operator's LLM API key","impact":"medium","summary":"Hugo Blog's AI assistant proxy exposes three endpoints with no authentication check. Any remote visitor can send arbitrary requests that the server forwards to the upstream LLM, embedding and rerank APIs using the operator's own API key.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hugo-blog","nginx","self-hosted"],"confidence":0.7,"fix_status":"none","needs_auth":"no","worst_case":"Attacker spends operator's LLM API key quota and causes cost exhaustion","analyst_note":"Confirm the fixed version or mitigation from the vendor advisory (github.com) and whether any patch has been released since publication.","how_to_check":"- Check whether the site exposes `POST /api/blog-assistant`, `POST /api/blog-search-embedding` or `POST /api/blog-search-rerank` without credentials.\n- Check the blog's commit history for `744ca15` or earlier in the deployed copy.\n- Check whether `OPENAI_API_KEY` or `AI_SEARCH_API_KEY` is set on the server.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Sites running the Hugo Blog project at commit 744ca15 or earlier with the AI assistant proxy enabled, especially behind the documented Nginx reverse-proxy setup, where the endpoints are reachable from the internet. Sites without the AI assistant features or with the endpoints blocked upstream are likely not exposed. The sources do not state a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000797,"input_tokens":4697,"output_tokens":655,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version or mitigation from the vendor advisory (github.com) and whether any patch has been released since publication.","search":"'-2026':14A,17A '-68905':15A,18A '/api/blog-assistant':93C '/api/blog-search-embedding':95C '/api/blog-search-rerank':97C '744ca15':81C 'ai':4A,36B,85C,141C 'api':11A,26B,64B,70B,128C,136C,139C,143C 'arbitrari':51B,118C 'assist':37B,86C 'attack':115C 'authent':44B,100C 'avail':167C 'blog':2A,20A,23B,34B,73C,77C 'check':45B,101C 'commit':80C 'consumpt':149C 'cost':150C 'cve':13A,16A 'deploy':103C 'document':106C 'embed':61B 'enabl':146C 'endpoint':41B,91C 'exhaust':151C 'expos':39B,88C 'follow':104C 'forward':56B,123C 'host':32B 'http':90C 'hugo':1A,19A,22B,33B,72C 'hugo-blog':21B 'key':12A,27B,71B,137C,140C,144C 'llm':10A,25B,60B 'llm-api-key':24B 'llm/embedding/rerank':127C 'nginx':28B,107C 'openai':138C 'oper':8A,67B,131C,158C 'packag':29B 'patch':168C 'post':92C,94C,96C 'potenti':153C 'prior':83C 'proxi':5A,38B,87C,110C,122C 'public':162C,166C 'quota':148C 'remot':47B,114C 'request':52B,119C 'rerank':63B 'revers':109C 'reverse-proxi':108C 'search':142C 'self':31B 'self-host':30B 'send':50B,117C 'server':55B,134C 'server-sid':133C 'servic':154C 'setup':111C 'side':135C 'site':78C 'spend':6A 'tech':76C 'three':40B,89C 'time':160C 'unauthent':3A,113C 'unavail':155C 'unlimit':147C 'upstream':59B,126C 'use':65B,129C 'visitor':48B 'without':98C","nicknames":[],"mitigations":[],"who_affected":"Sites running lanshi17/hugo_blog at commit 744ca15 or earlier that run the AI assistant proxy (npm run ai-proxy) with a server-side OPENAI_API_KEY or AI_SEARCH_API_KEY and expose /api/* publicly, as the documented Nginx setup does. Anyone can then spend the operator's LLM quota. Sites without the proxy, or with those endpoints blocked or authenticated upstream, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T21:30:10Z","by":"analyst","doc":"https://github.com/lanshi17/hugo_blog/security/advisories/GHSA-pj75-r769-qjv2","run_id":3934},"products":{"at":"2026-11-13T21:30:10Z","by":"analyst","doc":"https://github.com/lanshi17/hugo_blog/security/advisories/GHSA-pj75-r769-qjv2","run_id":3934},"how_to_check":{"at":"2026-11-13T21:30:10Z","by":"analyst","doc":"https://github.com/lanshi17/hugo_blog/security/advisories/GHSA-pj75-r769-qjv2","run_id":3934},"who_affected":{"at":"2026-11-13T21:30:10Z","by":"analyst","doc":"https://github.com/lanshi17/hugo_blog/security/advisories/GHSA-pj75-r769-qjv2","run_id":3934}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["hugoblog"],"ptokens":["blog","hugo"],"labels":["high","hugoblog","llmapikey","nginx","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-68905':15A,18A 'ai':4A 'api':11A 'blog':2A,20A 'cve':13A,16A 'hugo':1A,19A 'key':12A 'llm':10A 'oper':8A 'proxi':5A 'spend':6A 'unauthent':3A","search_b":"'ai':36B 'api':26B,64B,70B 'arbitrari':51B 'assist':37B 'authent':44B 'blog':23B,34B 'check':45B 'embed':61B 'endpoint':41B 'expos':39B 'forward':56B 'host':32B 'hugo':22B,33B 'hugo-blog':21B 'key':27B,71B 'llm':25B,60B 'llm-api-key':24B 'nginx':28B 'oper':67B 'packag':29B 'proxi':38B 'remot':47B 'request':52B 'rerank':63B 'self':31B 'self-host':30B 'send':50B 'server':55B 'three':40B 'upstream':59B 'use':65B 'visitor':48B","search_c":"'/api/blog-assistant':93C '/api/blog-search-embedding':95C '/api/blog-search-rerank':97C '744ca15':81C 'ai':85C,141C 'api':128C,136C,139C,143C 'arbitrari':118C 'assist':86C 'attack':115C 'authent':100C 'avail':167C 'blog':73C,77C 'check':101C 'commit':80C 'consumpt':149C 'cost':150C 'deploy':103C 'document':106C 'enabl':146C 'endpoint':91C 'exhaust':151C 'expos':88C 'follow':104C 'forward':123C 'http':90C 'hugo':72C 'key':137C,140C,144C 'llm/embedding/rerank':127C 'nginx':107C 'openai':138C 'oper':131C,158C 'patch':168C 'post':92C,94C,96C 'potenti':153C 'prior':83C 'proxi':87C,110C,122C 'public':162C,166C 'quota':148C 'remot':114C 'request':119C 'revers':109C 'reverse-proxi':108C 'search':142C 'send':117C 'server':134C 'server-sid':133C 'servic':154C 'setup':111C 'side':135C 'site':78C 'tech':76C 'three':89C 'time':160C 'unauthent':113C 'unavail':155C 'unlimit':147C 'upstream':126C 'use':129C 'without':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T09:12:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68905","severity":null,"published_at":"2026-11-13T20:19:00+00:00","modified_at":"2026-11-13T20:19:00+00:00","first_seen_at":"2026-11-13T21:27:24+00:00","fetched_at":"2026-11-13T21:27:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-68905:3934","url":null,"severity":null,"published_at":"2026-11-13T21:30:10+00:00","modified_at":"2026-11-13T21:30:10+00:00","first_seen_at":"2026-11-13T21:30:10+00:00","fetched_at":"2026-11-13T21:30:10+00:00","note":"Read GHSA-pj75-r769-qjv2 from lanshi17: affected commit 744ca15 and earlier, patched versions None, no patch released as of the advisory. PoC is inside the advisory (Docker mock-upstream); no exploitation reported."}],"documents":[{"id":149754,"url":"https://github.com/lanshi17/hugo_blog/security/advisories/GHSA-pj75-r769-qjv2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T09:12:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}