Missing Authorization Vulnerability in TencentCloud Octop
CVE-2026-108581

7.1HIGH

Key Information:

Vendor

Tencentcloud

Status
Octop
Vendor
CVE Published:
10 October 2026

What is CVE-2026-108581?

A missing authorization vulnerability in TencentCloud Octop version 1.0.2b6 allows authenticated low-privileged users to access sensitive stored provider API keys. This vulnerability is exploited via unauthenticated API endpoints, specifically GET /api/providers and GET /api/voice/providers, which only validate the JSON Web Token (JWT) without appropriate authorization checks. As a result, adversaries can retrieve plaintext API keys for LLM and voice providers, potentially leading to unauthorized access and abuse of upstream provider accounts.

Affected Version(s)

Octop 0 <= 1.0.2b6

References

https://github.com/TencentCloud/Octop/pull/1507
issue-trackingpatch
https://github.com/TencentCloud/Octop/pull/1265
issue-trackingpatch
https://hackmd.io/@haind/octop-provider-key-cross-role-read
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ra-co88
HaiND from the Post and Telecommunication Institute of Technology
.