CVE-2026-119648: BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated BlueKing CMDB user can exploit it. The attacker does not need elevated privileges or user interaction, but must be able to send POST requests to the affected host-search API endpoint.
What information can be exposed?
An attacker can retrieve host attributes and topology association details for hosts belonging to other businesses. Requests can target another business explicitly or omit business filters.
Are deployments affected by default?
The affected route is mapped to SkipAction, and the SearchHostWithAsstDetail handler does not perform AuthorizeSearchHost. As a result, access controls normally expected for host searches are not applied to this endpoint.
How can I determine whether my deployment is affected?
Deployments running Tencent BlueKing CMDB through version 3.14.6 are affected according to the available information. You can also validate exposure by using a low-privileged authenticated account to call POST /api/v3/hosts/search/asstdetail with search conditions for a different business or without a business filter and checking whether host data is returned.