CVE-2026-108581 Details
Description
TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain plaintext LLM and voice provider API keys and abuse the upstream provider accounts.
A missing authorization vulnerability exists in TencentCloud Octop versions through 1.0.2b6. This vulnerability allows authenticated low-privileged users to access stored provider API keys by querying the endpoints GET /api/providers and GET /api/voice/providers. The affected endpoints only validate the JSON Web Token (JWT), enabling users to retrieve plaintext API keys for language model (LLM) and voice providers, which could be misused on the respective provider accounts.
The vulnerability can be addressed by requiring the same 'providers' permission for the '/api/providers' route that is already enforced for the admin equivalent. Alternatively, if regular users need to access the provider list, the API response can be modified to exclude the API keys from non-privileged users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TencentCloud/Octop/blob/eb28011249c02cafd389b2d424294c6c1b9cf422/src/octop/api/routers/providers.py#L120-L208 | [email protected] | Source CodeVendor |
| https://github.com/TencentCloud/Octop/pull/1265 | [email protected] | Issue TrackingVendor |
| https://github.com/TencentCloud/Octop/pull/1507 | [email protected] | Issue TrackingVendor |
| https://hackmd.io/@haind/octop-provider-key-cross-role-read | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/octop-through-1.0-2b6-missing-authorization-exposes-provider-api-keys-via-api-providers | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TencentCloud Octop | <= 1.0.2b6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | [email protected] |