CVE-2026-68905
Hugo Blog: Unauthenticated AI Proxy Allows Abuse of Server-Side API Key
Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints (POST /api/blog-assistant, POST /api/blog-search-embedding, POST /api/blog-search-rerank) without any authentication check. When deployed following the documented Nginx reverse-proxy setup, any unauthenticated remote attacker can send arbitrary requests that the proxy forwards to the upstream LLM/embedding/rerank API using the operator's server-side API key (OPENAI_API_KEY / AI_SEARCH_API_KEY). This enables unlimited quota consumption, cost exhaustion, and potential service unavailability for the operator. At time of publication, there are no publicly available patches.
| CWE | CWE-306 |
| Vendor | lanshi17 |
| Product | hugo_blog |
| Published | Nov 13, 2026 |
Get instant alerts for lanshi17 hugo_blog
Be the first to know when new high vulnerabilities affecting lanshi17 hugo_blog are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H