Vulnerability · Published Oct 10, 2026 · Assigned by VulnCheck

CVE-2026-108581Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers

Medium 6.5

In plain English

A medium-severity missing authorization in Octop from TencentCloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain plaintext LLM and voice provider API keys and abuse the upstream provider accounts.

Affected products (as reported)

Vendor	Product	Versions
TencentCloud	Octop	0 – through 1.0.2b6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/TencentCloud/Octop/pull/1507 issue-tracking, patch
https://github.com/TencentCloud/Octop/pull/1265 issue-tracking, patch
https://hackmd.io/@haind/octop-provider-key-cross-role-read third-party-advisory
https://github.com/TencentCloud/Octop/blob/eb28011249c02cafd389b2d424294c6c1b9cf422/src/octop/api/routers/providers.py#L120-L208 technical-description
VulnCheck Advisory: Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers third-party-advisory