CVE-2026-119599

AxonHub service-account keys can gain unauthorized system read scopes

looplj / AxonHub · AxonHub AI gateway service-account API key scopes

First documented disclosure · Review checkpoint

Summary

A project user can mint a service-account key with system scopes they do not hold.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher performed static source review only and explicitly did not run a server or send the illustrative GraphQL requests. No exploitation or victim is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Key create/update paths store caller-provided scopes without the grant checks applied to role changes; an escalated read_channels key then passes unfiltered channel-query authorization.

Conditions required

An authenticated project user has write_api_keys but lacks system read_channels access.

Potential impact

Cross-project disclosure of channel configuration such as base URLs, model lists, tags and remarks. The report does not establish provider credential disclosure or write operations, which are constrained by separate GraphQL rules.

Affected versions and configurations

AxonHub through 1.0.0-beta11, according to the CNA.

Fix and mitigation status

Commit e5c904efbdabd80d74827dfae478330339c5a514 merged into unstable October 29; a containing numbered release was not verified.

Practical next steps

Deploy the upstream grant-validation fix or a supported release containing it. Restrict key-creation permissions meanwhile and audit existing service-account keys for scopes their creators could not legitimately grant.

Operating lesson

A credential must not convey authority its creator lacks; enforce grant checks on creation, updates and rotation.

Evidence and limits

A public issue linked the full report October 22; the fix PR opened October 23 and merged October 29, before October 30 CNA publication. The researcher labels the finding high qualitatively, while VulnCheck scores CVSS 4.0 5.3 and CVSS 3.1 4.3; the displayed severity is the attributed CVSS 4.0 result. Scope escalation does not establish every possible privileged action.

Sources