CVE-2026-129129 in AiSOC
Summary
by MITRE • 11/13/2026
AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to query the enrichment service through Next.js console rewrite routes. Attackers can send requests to /api/v1/enrichment/lookup or /api/v1/enrichment/bulk to retrieve threat-intelligence results and set force to true to consume commercial provider API quota.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in AiSOC versions prior to 23.3.0 represents a critical failure in access control mechanisms within the application's Next.js-based architecture. Specifically, the flaw resides in the rewrite routes that handle requests directed toward the enrichment service endpoints. These endpoints are designed to process threat intelligence lookups and bulk data queries, which typically require authenticated sessions or valid API credentials to ensure that only authorized personnel can initiate resource-intensive operations. However, due to a misconfiguration or omission in the authentication middleware for these specific paths, the system fails to verify the identity of the requester before processing the query. This oversight effectively exposes internal security tools and data sources to unauthenticated external actors who can interact with the backend services directly through HTTP requests without providing any form of credentials or tokens.
From a technical perspective, this vulnerability is classified as CWE-306: Missing Authentication for Critical Function. The attacker exploits the Next.js rewrite routes by sending crafted HTTP POST or GET requests to specific API endpoints such as /api/v1/enrichment/lookup and /api/v1/enrichment/bulk. These endpoints are intended to query external threat intelligence providers, which often operate on a pay-per-query model using commercial APIs. By leveraging the missing authentication check, an attacker can bypass the standard security gates that would normally validate user permissions or rate limits associated with authenticated accounts. The ability to send requests directly to these rewrite routes allows the adversary to interact with the enrichment service as if they were a legitimate, authorized user of the AiSOC platform, despite having no valid session or API key.
The operational impact of this vulnerability is twofold, involving both information disclosure and resource exhaustion. First, unauthenticated attackers can retrieve threat intelligence results that may contain sensitive data about network assets, known malicious indicators, or internal security configurations if such details are included in the enrichment responses. This exposure aids adversaries in reconnaissance activities by providing them with verified data regarding the target environment without needing to breach deeper layers of defense. Second, and potentially more damaging from a financial and operational standpoint, is the ability to consume commercial provider API quotas. By setting specific parameters such as force to true or simply sending high volumes of requests through the bulk endpoint, attackers can trigger expensive queries against third-party threat intelligence feeds. This leads to significant unexpected costs for the organization and may result in service degradation if the quota limits are exceeded, effectively causing a denial of service by exhausting available resources allocated for security operations.
This vulnerability aligns with MITRE ATT&CK technique T1592: Gather Victim Host Information, as it allows an attacker to collect data about the victim's environment through enrichment queries. Furthermore, it relates to T1496: Resource Hijacking if the primary intent is to exhaust API quotas for financial gain or disruption. The exploitation of this flaw does not require complex payload construction but rather relies on correctly formatted HTTP requests targeting the exposed endpoints. This simplicity increases the likelihood of automated scanning and exploitation by opportunistic attackers who routinely probe web applications for misconfigured authentication rules in their API layers.
Mitigation strategies must focus immediately on enforcing strict access control policies on all internal service routes, particularly those handling sensitive data or triggering external API calls. Administrators should ensure that the Next.js rewrite middleware correctly applies authentication checks before forwarding requests to the enrichment service backend. This can be achieved by integrating robust session validation logic into the route handlers for /api/v1/enrichment/lookup and /api/v1/enrichment/bulk, ensuring that only users with appropriate roles or valid API tokens are permitted to execute these functions. Additionally, implementing rate limiting at the application gateway level is crucial to prevent abuse of any remaining exposed endpoints and to mitigate potential denial-of-service scenarios caused by excessive query volumes. Upgrading AiSOC to version 23.3.0 or later resolves this issue as it includes the necessary patches for authentication enforcement on these critical paths.