CVE-2026-110208 in Wukong AICRM
Summary
by MITRE • 10/13/2026
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Wukong AICRM versions up to 20260610 represents a critical failure in access control mechanisms within the system configuration module. Specifically, the flaw resides in the /systemConfig controller endpoints which are designed to manage application settings but lack proper authorization checks for sensitive data retrieval and testing functions. This missing authorization issue allows any authenticated user, regardless of their privilege level or role assignment, to interact with these endpoints without verifying if they have administrative rights or a legitimate business need to access such information. In secure software architecture, configuration endpoints that handle secrets must enforce strict Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC) policies to ensure that only authorized administrators can view or modify sensitive parameters like API keys.
The technical exploitation of this vulnerability occurs through two primary vectors involving the manipulation of HTTP GET requests and POST data forwarding. First, an attacker can directly request the endpoint /systemConfig/byType/ai which returns the stored AI provider API key in cleartext within the response body. This direct exposure means that once a user authenticates to the application, they can trivially extract credentials intended for external service integration without needing any further privilege escalation or social engineering attacks. Second, the vulnerability extends to the /systemConfig/ai/test endpoint which is ostensibly designed for testing connectivity with AI providers but fails to validate the source of the request data. By sending a crafted apiUrl parameter along with other necessary fields, an attacker can cause the application to forward the stored API key to a server controlled by the attacker. This exfiltration method allows for remote collection of credentials without leaving obvious traces in local logs that might indicate direct database queries or file reads.
From an operational impact perspective, the compromise of AI provider API keys poses severe risks to both data confidentiality and financial integrity. These keys typically grant access to large language model services which may incur significant costs based on usage volume; therefore, unauthorized use can lead to substantial billing fraud where attackers consume computational resources at the victim organization's expense. Furthermore, if the AI service is integrated with internal systems or processes sensitive customer data, the exposure of these credentials could facilitate broader attacks such as prompt injection campaigns, data leakage through malicious queries sent via the compromised API, or lateral movement within the network infrastructure that relies on this integration for automation tasks. The ability to exfiltrate keys remotely amplifies the threat landscape by enabling persistent access even if initial authentication tokens are rotated or revoked, provided the attacker retains control over their receiving server and can trigger re-authentication cycles in the target application.
This vulnerability aligns with CWE-284 Improper Access Control as it demonstrates a failure to restrict information disclosure based on user roles. Additionally, the technique of forwarding stored secrets to an external host corresponds to ATT&CK T1567 Exfiltration Over Web Service and potentially T1078 Valid Accounts if the initial authentication was obtained through credential theft or phishing. To mitigate this risk, developers must implement strict authorization checks on all configuration endpoints ensuring that only users with explicit administrative privileges can access sensitive settings. The /systemConfig/byType/ai endpoint should be restricted to admin roles exclusively and return masked values unless explicitly requested by authorized personnel under secure conditions. For the testing functionality at /systemConfig/ai/test, input validation must ensure that apiUrl parameters are whitelisted against known internal domains or require explicit administrative approval before execution. Furthermore, implementing rate limiting on these endpoints can help detect automated scraping attempts while rotating API keys regularly and monitoring for unusual outbound traffic patterns associated with exfiltration activities provides an additional layer of defense in depth.