CVE-2026-73079
Received Received - Intake

Sub2API API Key Relay Path Traversal Vulnerability

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts (ChatGPT/Codex OAuth, OpenAI platform keys, or an operator-configured base URL) that belong to the operator, not to the caller. The `POST /responses/*subpath` wildcard routes spliced the client-supplied subpath into the upstream URL with no validation. This lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials via a path traversal. This vulnerability is fixed in 0.1.169.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73079
EUVD
EUVD-2026-56237

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wei-shaw sub2api From 0.1.135 (inc) to 0.1.168 (inc)
sub2api sub2api 0.1.169

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73079 is a path traversal vulnerability in the Sub2API AI API gateway affecting versions 0.1.135 to 0.1.168. It allows authenticated tenants to manipulate URL paths in POST requests to arbitrary upstream endpoints using shared provider credentials. The issue occurs because client-supplied subpaths in wildcard routes like /responses/*subpath are spliced into upstream URLs without validation, enabling path traversal attacks.

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to /responses/*subpath routes for path traversal patterns like ..%2f or excessive path depth. Check logs for requests with invalid characters or segments in the subpath. Use tools like curl to test for path manipulation: curl -X POST 'http://target/responses/..%2f..%2fetc/passwd' or similar variations.

Impact Analysis

An attacker could exploit this to send requests to unintended internal or external endpoints under the operator's credentials. This may lead to unauthorized data access, service disruption, or bypassing security controls. The high CVSS score (8.5) reflects significant confidentiality impact due to potential data exposure.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or disclosure, which is a critical issue under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected versions may face regulatory penalties, reputational damage, and loss of customer trust due to potential data breaches.

Mitigation Strategies

Upgrade to Sub2API version 0.1.169 or later immediately. If upgrading is not possible, implement a reverse proxy rule to reject requests containing invalid characters like ..%2f, .%2e, or excessive path segments in the /responses/ path. Block requests with pure dot segments or control characters in model names or request IDs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73079. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart