CVE-2026-119599
Received Received - Intake

Privilege Escalation in AxonHub via Unvalidated API Key Scopes

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119599
EUVD
EUVD-2026-113936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
looplj AxonHub 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

AxonHub through version 1.0.0-beta11 has a privilege escalation vulnerability where users with write_api_keys permissions can create service account API keys with unvalidated scopes. This allows them to assign system-level privileges like read_channels, enabling access to sensitive channel configurations across all tenants via the /admin/graphql endpoint.

Detection Guidance

Check AxonHub API key creation logs for service_account keys with system-level scopes like read_channels. Review GraphQL queries to /admin/graphql endpoints for unauthorized access patterns. Inspect API key scope assignments in versions up to 1.0.0-beta11.

Impact Analysis

Attackers with write_api_keys permissions can escalate privileges to read all channel configurations, including base URLs and model lists. This could lead to unauthorized data exposure across multiple tenants in the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy) due to uncontrolled data exposure across tenants.

Mitigation Strategies

Upgrade AxonHub to a patched version beyond 1.0.0-beta11. Revoke all service_account API keys created by users with write_api_keys permissions. Enforce scope validation during API key creation and updates. Monitor for unauthorized GraphQL queries to /admin/graphql.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119599. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart