{"id":"CVE-2026-68905","summary":"Hugo Blog: Unauthenticated AI Proxy Allows Abuse of Server-Side API Key","details":"Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints (POST /api/blog-assistant, POST /api/blog-search-embedding, POST /api/blog-search-rerank) without any authentication check. When deployed following the documented Nginx reverse-proxy setup, any unauthenticated remote attacker can send arbitrary requests that the proxy forwards to the upstream LLM/embedding/rerank API using the operator's server-side API key (OPENAI_API_KEY / AI_SEARCH_API_KEY). This enables unlimited quota consumption, cost exhaustion, and potential service unavailability for the operator. At time of publication, there are no publicly available patches.","aliases":["GHSA-pj75-r769-qjv2"],"modified":"2026-11-15T02:30:22.522690691Z","published":"2026-11-13T19:21:26.887Z","database_specific":{"cwe_ids":["CWE-306"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68905.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68905.json"},{"type":"ADVISORY","url":"https://github.com/lanshi17/hugo_blog/security/advisories/GHSA-pj75-r769-qjv2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68905"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lanshi17/hugo_blog","events":[{"introduced":"0"},{"last_affected":"744ca1563032e8a881390d3ed55d9a3ef2928502"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"744ca1563032e8a881390d3ed55d9a3ef2928502"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68905.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}]}