CVE-2026-85241 in BloodHound
Summary
by MITRE • 09/04/2026
A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. Upgrading to version 9.6.0-rc1, 9.6.0 and 9.7.0-rc3 is sufficient to fix this issue. This patch is called 39d1276a63e95a7713f954dea632a19651d9cebb. You should upgrade the affected component.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
A critical authorization flaw has been identified in SpecterOps BloodHound, specifically affecting versions up to 9.5.1. The vulnerability resides within the NewV2API function located in the file cmd/api/src/api/registration/v2.go, which is part of the Graph Write Endpoint component. This architectural weakness allows for improper authorization controls that can be exploited by an attacker to bypass intended access restrictions. Because this endpoint handles registration and graph data operations, a successful exploitation could allow unauthorized users to manipulate security-relevant data or escalate privileges within the BloodHound environment, potentially compromising the integrity of active directory mapping and analysis efforts.
The technical nature of this flaw aligns with CWE-287, which describes Improper Authentication, and more specifically relates to authorization failures where access control checks are insufficiently enforced during API registration processes. From a tactical perspective, an attacker leveraging this vulnerability would likely utilize techniques associated with MITRE ATT&CK T1098, specifically Account Manipulation or Privilege Group Membership modifications if the endpoint allows changes to user roles or group memberships within the BloodHound database. The ability to launch attacks remotely significantly increases the risk profile, as it does not require local access or prior authentication credentials that would normally restrict such actions. This remote exploitability means that any exposed instance of the vulnerable software is at immediate risk of unauthorized modification or data exfiltration depending on the specific capabilities granted by the flawed endpoint logic.
The operational impact of this vulnerability extends beyond simple privilege escalation within BloodHound itself. Since BloodHound is frequently used to map attack paths and identify high-value targets in enterprise environments, compromising its integrity can lead to misleading security assessments. An attacker could alter the graph data to hide their presence or redirect analyst attention away from critical infrastructure. Furthermore, if the API endpoint interacts with external identity providers or databases, there may be secondary risks involving injection attacks or further lateral movement depending on how the backend systems are configured and secured. The lack of proper authorization checks in this specific function creates a blind spot that security teams relying on BloodHound for threat hunting could inadvertently exploit against themselves if left unpatched.
To mitigate this risk, organizations must upgrade their SpecterOps BloodHound installations to version 9.6.0-rc1, version 9.6.0, or version 9.7.0-rc3 and later. These versions contain the necessary code changes that address the authorization logic errors in the NewV2API function. The specific patch resolving this issue is identified by commit hash 39d1276a63e95a7713f954dea632a19651d9cebb, which should be verified during deployment to ensure the correct fix has been applied. Until the upgrade is complete, it is advisable to restrict network access to the BloodHound API endpoints using firewalls or reverse proxies that enforce strict authentication and authorization policies at the infrastructure level rather than relying solely on application-level controls. Regular audits of user permissions and review of audit logs for unusual registration activities can also help detect any potential exploitation attempts before they result in significant compromise.