CVE-2026-108581CWE-862broken-access-control

CVE-2026-108581

Medium · published October 10, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain plaintext LLM and voice provider API keys and abuse the upstream provider accounts.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00238 · 14.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-10T20:16Z
References (5)
https://github.com/TencentCloud/Octop/blob/eb28011249c02cafd389b2d424294c6c1b9cf422/src/octop/api/routers/providers.py#L120-L208 · [email protected]https://github.com/TencentCloud/Octop/pull/1265 · [email protected]https://github.com/TencentCloud/Octop/pull/1507 · [email protected]https://hackmd.io/@haind/octop-provider-key-cross-role-read · [email protected]https://www.vulncheck.com/advisories/octop-through-1.0-2b6-missing-authorization-exposes-provider-api-keys-via-api-providers · [email protected]
EPSS history
Timeline
  • 12 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 10 OCT 15:57Z
    Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers
    cvelistv5
  • 10 OCT 15:57Z
    Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers
    cvelistv5