CVE-2026-68905: Hugo Blog: Unauthenticated AI Proxy Allows Abuse of Server-Side API Key

Published Nov 13, 2026

Updated

Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints (POST /api/blog-assistant, POST /api/blog-search-embedding, POST /api/blog-search-rerank) without any authentication check. When deployed following the documented Nginx reverse-proxy setup, any unauthenticated remote attacker can send arbitrary requests that the proxy forwards to the upstream LLM/embedding/rerank API using the operator's server-side API key (OPENAIAPIKEY / AISEARCHAPIKEY). This enables unlimited quota consumption, cost exhaustion, and potential service unavailability for the operator. At time of publication, there are no publicly available patches.

Affected Software

1 affected component

Hugo Blog

Event History

Nov 13, 2026

CVE Published

via MITRE·07:21 PM

Data Sourced

via MITRE·07:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments using the documented Nginx reverse-proxy setup are exposed if the AI assistant proxy endpoints are reachable by unauthenticated remote users. The affected endpoints are /api/blog-assistant, /api/blog-search-embedding, and /api/blog-search-rerank.

What does an attacker need to exploit it?

An attacker needs only network access to one of the exposed HTTP endpoints. No authentication, privileges, or user interaction are required.

What is the likely impact of exploitation?

Requests are forwarded to the upstream LLM, embedding, or reranking service using the operator's server-side API key. An attacker can consume API quota and generate costs until the operator's quota is exhausted or the service becomes unavailable.

What can be done while no patch is available?

Restrict access to the three proxy endpoints so unauthenticated remote users cannot reach them. This is particularly important for deployments following the documented Nginx reverse-proxy configuration.

How can I determine whether my deployment is affected?

Check whether your deployment is at commit 744ca15 or earlier and whether any of the three listed POST endpoints can be reached without authentication. Also verify whether OPENAI_API_KEY or AI_SEARCH_API_KEY is configured for the proxy.

CVE-2026-68905: Hugo Blog: Unauthenticated AI Proxy Allows Abuse of Server-Side API Key

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of exploitation?

What can be done while no patch is available?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of exploitation?

What can be done while no patch is available?

How can I determine whether my deployment is affected?