Missing authorization in TencentCloud Octop exposes provider API keys
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
TencentCloud Octop through 1.0.2b6 contains a missing authorization flaw (CWE-862) that lets authenticated low-privileged users read stored provider API keys. The endpoints GET /api/providers and GET /api/voice/providers only validate the JWT and do not check permissions. An attacker can obtain plaintext LLM and voice provider API keys and abuse the upstream provider accounts.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain plaintext LLM and voice provider API keys and abuse the upstream provider accounts.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TencentCloud | Octop | up to 1.0.2b6 | — | No fix listed | CNA |
- Octop VendorTencentCloud Affected up to 1.0.2b6 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for TencentCloud Octop.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108581
- 2026-10-11 Alias added: GHSA-c344-c8vm-8rxv
- 2026-10-11 Priority changed: MEDIUM → LOW
- 2026-10-18 CISA SSVC decision points changed
References
Patch 2
Sources
- CVE-2026-108581 · CVE Program
- CVE-2026-108581 · NVD
- FIRST EPSS
- GHSA-c344-c8vm-8rxv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences