Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck
CVE-2026-110208Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys
High 7.1
In plain English
A high-severity missing authorization in Wukong AICRM from WuKongOpenSource. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 66.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WuKongOpenSource | Wukong AICRM | 0 – through 20260610 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- Researcher Advisory third-party-advisory
- Vulnerable Code: SystemConfigServiceImpl AI test (20260610) technical-description
- Vulnerable Code: SystemConfigServiceImpl.getConfigsByType (20260610) technical-description
- Vulnerable Code: SystemConfigServiceImpl.resolveSecret (20260610) technical-description
- SystemConfigController (20260610) technical-description
- https://github.com/WuKongOpenSource/Wukong-AICRM product
- VulnCheck Advisory: Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys third-party-advisory