CVE-2026-119599 in AxonHub
Summary
by MITRE • 10/30/2026
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The AxonHub platform, specifically through version 1.0.0-beta11, suffers from a critical privilege escalation vulnerability rooted in insufficient validation of scope parameters during the creation of service account API keys. This flaw allows authenticated users with write_api_keys permissions to bypass intended access controls by assigning system-level scopes that should be restricted to administrative roles only. The core technical deficiency lies in the lack of server-side authorization checks when processing requests for new key generation, enabling malicious actors to mint tokens with elevated privileges such as read_channels and broader query capabilities than their original role permits.
This vulnerability directly impacts the confidentiality and integrity of the platform's data architecture by allowing unauthorized access to sensitive configuration details. Attackers possessing write_api_keys can exploit this flaw to generate service account keys that grant them the ability to execute queries against the /admin/graphql endpoint. Through these elevated permissions, adversaries can retrieve comprehensive configurations for every channel within the system, including base URLs and model lists. This exposure not only reveals internal infrastructure topology but also provides attackers with detailed insights into the specific AI models and endpoints being utilized, which can facilitate further targeted attacks or social engineering efforts against other users of the platform.
From a classification perspective, this issue aligns closely with CWE-269, Improper Privilege Management, as it involves an actor obtaining privileges they are not authorized to possess due to flawed access control logic. Furthermore, the exploitation technique maps to MITRE ATT&CK techniques such as T1078, Valid Accounts, where attackers leverage legitimate credentials to gain unauthorized access, and potentially T1530, Data from Cloud Storage Object Dumps, if the exposed channel configurations lead to broader data exfiltration scenarios. The ability to query administrative endpoints via GraphQL also highlights risks associated with improper input validation in API layers, which can be categorized under CWE-284, Improper Access Control.
The operational impact of this vulnerability is severe, as it undermines the fundamental security model of multi-tenant environments by allowing lateral movement and data aggregation across channels that should remain isolated. By exposing base URLs and model lists, attackers gain a strategic advantage in understanding the system's capabilities and potential weaknesses. This information can be used to craft more sophisticated attacks against specific models or infrastructure components identified through the exposed configurations. Additionally, the creation of persistent service account keys with high privileges ensures long-term unauthorized access unless detected and remediated promptly.
To mitigate this vulnerability, immediate action should focus on implementing strict server-side validation for all scope parameters during API key generation processes. Developers must ensure that only users with explicit administrative roles can assign system-level scopes such as read_channels or query /admin/graphql endpoints. Implementing role-based access control checks at the point of request processing is essential to prevent privilege escalation. Additionally, adopting a principle of least privilege by default for all new keys and auditing existing key permissions will help reduce the attack surface. Regular security assessments and penetration testing focused on API authorization logic are recommended to identify similar flaws in other parts of the application stack before they can be exploited in production environments.