Authentication Bypass in Hugo Blog AI Assistant Proxy
CVE-2026-68905

8.2HIGH

Key Information:

Vendor

Lanshi17

Status
Hugo Blog
Vendor
CVE Published:
13 November 2026

What is CVE-2026-68905?

The AI assistant proxy in Hugo Blog has a security flaw where it exposes three critical HTTP endpoints—/api/blog-assistant, /api/blog-search-embedding, and /api/blog-search-rerank—without proper authentication mechanisms. This vulnerability allows attackers to send arbitrary requests that can exploit the operator's server-side API keys, such as OPENAI_API_KEY and AI_SEARCH_API_KEY. Consequently, an unauthenticated remote attacker can consume the operator’s quota, leading to potential cost exhaustion and service disruption. As of now, no patches are available to mitigate this issue.

Affected Version(s)

hugo_blog <= 744ca1563032e8a881390d3ed55d9a3ef2928502

References

https://github.com/lanshi17/hugo_blog/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.