CVE-2026-123788: chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow
A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voicewshandler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
chenyme grok2apito a version that resolves this vulnerability.Fixed in 3.1.7Patch 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4
Event History
Frequently Asked Questions
Which versions need to be remediated?
chenyme grok2api versions up to and including 3.1.6 are affected. Upgrading to version 3.1.7 resolves the issue.
Can this be exploited remotely?
Yes. The available information states that the attack may be initiated remotely, though it does not specify any required authentication or request conditions.
What component should be prioritized during triage?
Prioritize the STT Billing component, specifically the behavior associated with backend/internal/transport/http/inference/voice_ws_handler.go. The provided data does not identify the affected function within that file.
How can the remediation be verified?
Confirm that the deployed grok2api version is 3.1.7 or later. The patch is identified as commit 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4.