---
id: "CVE-2026-68905"
page: "https://infrastack.ai/live/CVE-2026-68905"
kind: "vulnerability"
aliases: ["CVE-2026-68905"]
title: "Hugo Blog: unauthenticated AI proxy spends the operator's LLM API key"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "hugo_blog", "fixed": [], "affected": "commit 744ca15 and earlier", "ecosystem": "github"}]
ecosystems: []
tags: ["hugo-blog", "llm-api-key", "nginx", "package", "self-hosted"]
not_affected_if: ["ai-proxy-not-running", "auth-required", "default-config", "endpoints-blocked-at-proxy"]
published_at: "2026-11-13T20:19:00+00:00"
first_seen_at: "2026-11-13T21:27:24+00:00"
updated_at: "2026-11-13T21:30:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68905", "first_seen_at": "2026-11-13T21:27:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T21:30:10+00:00"}]
exploit_sources: []
---

# Hugo Blog: unauthenticated AI proxy spends the operator's LLM API key

Link for people: https://infrastack.ai/live/CVE-2026-68905 (this .md is for agents)

Hugo Blog's AI assistant proxy exposes three endpoints with no authentication check. Any remote visitor can send arbitrary requests that the server forwards to the upstream LLM, embedding and rerank APIs using the operator's own API key.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:hugo_blog affected commit 744ca15 and earlier fixed no fixed version listed

## How to check

- Check the deployed copy's server/ai-assistant-proxy.mjs: the route gate near line 249 checks only method and path, with no auth.
- Check whether your Nginx config exposes /api/* publicly (as in docs/ai-assistant-nginx.example.conf) and whether POST /api/blog-assistant, /api/blog-search-embedding or /api/blog-search-rerank answers without credentials.
- Check whether OPENAI_API_KEY or AI_SEARCH_API_KEY is set for the proxy, and whether ALLOWED_ORIGIN is unset (defaults to *).
- Check the deployed commit: 744ca15 or earlier is affected; no later fixed commit is named.

## Fix

No fixed version: the advisory lists patched versions as None. Until a patch exists, block /api/blog-assistant, /api/blog-search-embedding and /api/blog-search-rerank at the proxy or require auth, set ALLOWED_ORIGIN to your own origin, and set spend limits on the upstream key.

## Timeline

- 2026-11-13T21:27:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68905
- 2026-11-13T21:30:10+00:00 analyst — Read GHSA-pj75-r769-qjv2 from lanshi17: affected commit 744ca15 and earlier, patched versions None, no patch released as of the advisory. PoC is inside the advisory (Docker mock-upstream); no exploitation reported.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/lanshi17/hugo_blog/security/advisories/GHSA-pj75-r769-qjv2

## From the sources

Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints (POST /api/blog-assistant, POST /api/blog-search-embedding, POST /api/blog-search-rerank) without any authentication check. When deployed following the documented Nginx reverse-proxy setup, any unauthenticated remote attacker can send arbitrary requests that the proxy forwards to the upstream LLM/embedding/rerank API using the operator's server-side API key (OPENAI_API_KEY / AI_SEARCH_API_KEY). This enables unlimited quota consumption, cost exhaustion, and potential service unavailability for the operator. At time of publication, there are no publicly available patches.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_