CVE-2026-85241

Received Received - Intake

Improper Authorization in BloodHound Graph Write Endpoint

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulDB

Description

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. Upgrading to version 9.6.0-rc1, 9.6.0 and 9.7.0-rc3 is sufficient to fix this issue. This patch is called 39d1276a63e95a7713f954dea632a19651d9cebb. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-85241

Affected Vendors & Products

Vendor	Product	Version / Range
specterops	bloodhound	to 9.5.1 (inc)
specterops	bloodhound	9.6.0
specterops	bloodhound	9.6.0-rc1
specterops	bloodhound	9.7.0-rc3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authorization weakness in SpecterOps BloodHound versions up to 9.5.1. It exists in the NewV2API function of the Graph Write Endpoint file cmd/api/src/api/registration/v2.go. An attacker can remotely exploit this to gain unauthorized access or perform actions they should not be able to.

Detection Guidance

This vulnerability is specific to SpecterOps BloodHound versions up to 9.5.1. Detection involves checking the installed version of BloodHound. Use commands like 'bloodhound --version' or inspect the file 'cmd/api/src/api/registration/v2.go' for the affected function NewV2API.

Impact Analysis

If you use BloodHound up to version 9.5.1, an attacker could remotely manipulate the system to bypass authorization checks. This may allow them to read, modify, or delete data they are not authorized to access, potentially leading to data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Upgrade BloodHound to version 9.6.0-rc1, 9.6.0, or 9.7.0-rc3 or later. Apply the patch identified as 39d1276a63e95a7713f954dea632a19651d9cebb to fix the improper authorization issue.

Hi! I’m here to help you understand CVE-2026-85241. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70