Read the docs
TI-2026-86141 Aliases CVE-2026-123788GHSA-279p-xx78-79p3

Improper workflow enforcement in chenyme grok2api STT billing

Priority LOW 24CWE-840Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

chenyme grok2api up to 3.1.6 contains a flaw in the STT Billing component, in the file backend/internal/transport/http/inference/voice_ws_handler.go. Improper enforcement of behavioral workflow (CWE-841) lets a user manipulate the intended workflow. A remote attacker with low privileges and no user interaction can trigger it, and it affects integrity.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended.

Why it matters now

EPSS 0.00268 19th percentileScored 2026-11-07
Fix Fixed grok2api (chenyme): 3.1.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
chenymegrok2api3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; 3.1.63.1.7Patch availableCNA
  • grok2api Vendorchenyme Affected 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; 3.1.6 Fixed in 3.1.7 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*——chenyme
  • cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:* Versions — — ·chenyme

Remediation

Upgrade chenyme grok2api to version 3.1.7, which contains the patch 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA grok2api (chenyme) Fixed in 3.1.7

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123788
  2. 2026-11-07 Alias added: GHSA-279p-xx78-79p3

References

Patch 3

Other 2

  • TI-2026-86043 Uncontrolled resource consumption in chenyme grok2api WebSocket proxy CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences