{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68905","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-07-31T21:04:04.040Z","datePublished":"2026-11-13T19:21:26.887Z","dateUpdated":"2026-11-13T19:21:26.887Z"},"containers":{"cna":{"title":"Hugo Blog: Unauthenticated AI Proxy Allows Abuse of Server-Side API Key","problemTypes":[{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"CWE-306: Missing Authentication for Critical Functionality","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"}}],"references":[{"name":"https://github.com/lanshi17/hugo_blog/security/advisories/GHSA-pj75-r769-qjv2","tags":["x_refsource_CONFIRM"],"url":"https://github.com/lanshi17/hugo_blog/security/advisories/GHSA-pj75-r769-qjv2"}],"affected":[{"vendor":"lanshi17","product":"hugo_blog","versions":[{"version":"<= 744ca1563032e8a881390d3ed55d9a3ef2928502","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-13T19:21:26.887Z"},"descriptions":[{"lang":"en","value":"Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints (POST /api/blog-assistant, POST /api/blog-search-embedding, POST /api/blog-search-rerank) without any authentication check. When deployed following the documented Nginx reverse-proxy setup, any unauthenticated remote attacker can send arbitrary requests that the proxy forwards to the upstream LLM/embedding/rerank API using the operator's server-side API key (OPENAI_API_KEY / AI_SEARCH_API_KEY). This enables unlimited quota consumption, cost exhaustion, and potential service unavailability for the operator. At time of publication, there are no publicly available patches."}],"source":{"advisory":"GHSA-pj75-r769-qjv2","discovery":"UNKNOWN"}}}}