CVE-2026-125751: Meteroid before 2.2.0 Cross-Tenant API Token Hash Disclosure via GetApiTokenById

Published Nov 10, 2026

Updated

Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash and owning tenant ID.

Event History

Nov 10, 2026

CVE Published

via MITRE·03:22 PM

Data Sourced

via MITRE·03:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Meteroid user with the settings:read permission can exploit it. The attacker also needs the ID of an API token belonging to a different tenant.

What information can be disclosed?

The affected handler can disclose the target API token's Argon2 secret hash and the ID of the tenant that owns the token. The available data does not indicate direct disclosure of the plaintext API token secret.

Which deployments are affected?

Meteroid versions before 2.2.0 are affected. The exposed gRPC handler is reachable by users granted settings:read; the data does not establish whether that permission is granted by default.

What should be done if immediate upgrading is not possible?

Restrict settings:read permission to only trusted users until an upgrade to 2.2.0 is possible. Review access to the GetApiTokenById handler and investigate requests for API token IDs associated with other tenants.

CVE-2026-125751: Meteroid before 2.2.0 Cross-Tenant API Token Hash Disclosure via GetApiTokenById

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be disclosed?

Which deployments are affected?

What should be done if immediate upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be disclosed?

Which deployments are affected?

What should be done if immediate upgrading is not possible?