CVE-2026-108596 in OpenLIT
Summary
by MITRE • 10/10/2026
OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
OpenLIT version 2.1.0 is susceptible to an authorization bypass vulnerability that stems from improper enforcement of access controls on telemetry data endpoints. The core technical flaw lies in the application's reliance on a custom HTTP header, specifically x-openlit-project-id, for determining project-level scope and permissions rather than validating this identifier against authenticated user session context or server-side ownership records. This design oversight allows an attacker who has valid authentication credentials to manipulate request parameters directly. By forging the value of the x-openlit-project-id header to match a target victim's project identifier, the application fails to verify whether the requesting user actually possesses administrative or read access rights for that specific project. Consequently, the system treats the forged identifier as legitimate and proceeds with data retrieval operations without performing adequate cross-reference checks against authorized resource lists.
The operational impact of this vulnerability is significant due to the sensitive nature of telemetry data within modern software development pipelines. Telemetry systems often capture detailed execution traces, including input prompts and model completions when integrating with Large Language Models or other complex services. An attacker leveraging this flaw can query trace read APIs using a known victim project ID combined with database configuration identifiers they may have obtained through prior reconnaissance or information disclosure. This capability enables the exfiltration of proprietary code logic, internal API structures, and potentially sensitive user data embedded within LLM interactions such as customer queries or personal identifiable information processed by AI models. The ability to read these traces without authorization compromises both confidentiality and integrity of organizational intellectual property while violating regulatory compliance requirements regarding data protection.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing restrictive policies on authorized users accessing resources belonging to other entities. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, where attackers utilize legitimate credentials to gain unauthorized access to specific data segments by manipulating contextual parameters rather than breaking authentication mechanisms entirely. The exploitation path demonstrates how reliance on client-supplied identifiers for security decisions creates a direct pathway for privilege escalation within the scope of existing permissions.
Mitigation strategies must prioritize server-side validation of resource ownership over trust in HTTP headers or request parameters. Developers should implement strict authorization checks that verify the authenticated user's relationship to the requested project ID against backend access control lists before processing any telemetry queries. Additionally, implementing role-based access controls with least privilege principles ensures that users can only interact with resources explicitly assigned to their roles. Input validation should reject malformed or unexpected header values, and audit logging must be enabled to detect anomalous patterns of cross-project data access attempts. Regular security assessments focusing on API endpoint authorization logic are recommended to identify similar flaws in distributed telemetry architectures before they can be exploited by malicious actors seeking to harvest sensitive operational intelligence.