CVE-2026-9305: QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection
A weakness has been identified in QuantumNous new-api up to 0.12.1. The impacted element is the function SearchUserTopUps/SearchAllTopUps of the file model/topup.go of the component self Endpoint. This manipulation causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
QuantumNous new-api self Endpointfrom your environment.If the self Endpoint (topup component) is not required, uninstall or remove it from production until a secure fix is available.
- Configuration
Disable the SearchAllTopUps/SearchUserTopUps endpoint in model/topup.go until a code fix is implemented.
QuantumNous new-api self Endpoint SearchAllTopUps (SearchUserTopUps) endpoint = disabled - Configuration
Update the SearchAllTopUps/SearchUserTopUps implementation to eliminate SQL injection by using parameterized queries (prepared statements) and validating or sanitizing all inputs.
QuantumNous new-api (topup.go, SearchAllTopUps) SQL handling / input validation = use parameterized queries and validate inputs - Compensating control
Restrict access to the affected endpoint: limit network access to trusted IP ranges or internal networks, apply WAF rules to block SQL-injection patterns, and monitor/block requests targeting SearchAllTopUps until patched.
- Operational
Assume possible exploitation (public exploit available): review and retain relevant logs, investigate for signs of compromise, and rotate any credentials, API keys, or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9305?
CVE-2026-9305 has a severity rating of medium with a score of 6.3.
What type of vulnerability is CVE-2026-9305?
CVE-2026-9305 is an SQL injection vulnerability.
How can I exploit CVE-2026-9305?
An attacker can exploit CVE-2026-9305 remotely through the SearchUserTopUps/SearchAllTopUps function in the model/topup.go file.
How do I fix CVE-2026-9305?
To fix CVE-2026-9305, you should update QuantumNous new-api to version 0.12.2 or later.
What components of QuantumNous are affected by CVE-2026-9305?
CVE-2026-9305 affects the self Endpoint within the QuantumNous new-api.