EFAK Missing Authorization in /api/model-config Exposes LLM API Keys
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
EFAK 5.0.0 through 5.1.0 is affected by a missing authorization flaw (CWE-862) that lets authenticated low-privilege users read LLM provider API keys. Any ROLE_USER account can query the /api/model-config endpoints to retrieve unmasked keys. An attacker with such an account can access the provider accounts and incur costs.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for EFAK.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111682
- 2026-10-16 Alias added: GHSA-jqpg-p8wq-hcmv
- 2026-10-18 CISA SSVC decision points changed
References
Other 3
- https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/controller/ModelConfigController.java#L34-L56
- https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/security/config/WebSecurityConfig.java#L89-L93
- https://github.com/smartloli/EFAK
More smartloli vulnerabilities
- TI-2026-75467 Missing authorization in EFAK lets users gain administrator rights CVSS 4.0HIGH 8.7
Sources
- CVE-2026-111682 · CVE Program
- CVE-2026-111682 · NVD
- FIRST EPSS
- GHSA-jqpg-p8wq-hcmv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences