Missing Authentication in AiSOC 12.1.0 Allows Unauthenticated Access

CVE-2026-129129

What is CVE-2026-129129?

The AiSOC platform version 12.1.0 and prior versions contain a vulnerability that permits unauthenticated attackers to access the enrichment service by exploiting Next.js console rewrite routes. This flaw enables attackers to send crafted requests to designated API endpoints such as /api/v1/enrichment/lookup or /api/v1/enrichment/bulk. By manipulating the request parameters, an attacker can retrieve sensitive threat intelligence data and may configure their requests to exhaust commercial provider API quotas, potentially leading to further exploitation.

References