CVE-2026-9306: QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization
A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router/relay-router.go of the component Midjourney Image Relay Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
QuantumNous new-api Midjourney Image Relay Endpointfrom your environment.Uninstall or remove the Midjourney Image Relay Endpoint component if it is not required by your deployment to eliminate exposure from this vulnerable handler.
- Configuration
Disable the RelayMidjourneyImage/GetByOnlyMJId handler or otherwise disable the Midjourney Image Relay Endpoint until a vendor patch or fix is available.
QuantumNous new-api Midjourney Image Relay Endpoint (router/relay-router.go) GetByOnlyMJId endpoint enabled = false - Compensating control
Restrict network access to the Midjourney Image Relay Endpoint (router/relay-router.go GetByOnlyMJId) to trusted IPs/networks via firewall rules, VPN, or WAF; apply request filtering or rate-limiting to block or mitigate exploit attempts.
- Operational
Audit and monitor access logs for the RelayMidjourneyImage/GetByOnlyMJId endpoint for suspicious activity; investigate any unexpected accesses and, if compromise is suspected, follow incident response procedures (including credential and key rotation as appropriate).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9306?
CVE-2026-9306 has a severity rating of low, with a score of 3.7.
What kind of vulnerability is CVE-2026-9306?
CVE-2026-9306 is an authorization bypass vulnerability in the QuantumNous new-api.
How does CVE-2026-9306 affect users?
CVE-2026-9306 allows potential unauthorized access to the RelayMidjourneyImage/GetByOnlyMJId function.
How do I fix CVE-2026-9306?
To mitigate CVE-2026-9306, update QuantumNous new-api to version 0.12.2 or later.
When was CVE-2026-9306 published?
CVE-2026-9306 was published on May 23, 2026.