Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119648BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail

Medium 4.3

In plain English

A medium-severity missing authorization in bk-cmdb from TencentBlueKing. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 78.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.

Affected products (as reported)

Vendor	Product	Versions
TencentBlueKing	bk-cmdb	0 – through 3.14.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/TencentBlueKing/bk-cmdb/issues/8709 issue-tracking
https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/service/host.go#L605-L620 technical-description
https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/ac/parser/host.go#L797-L819 technical-description
https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/logics/hostsearch.go#L36-L72 technical-description
https://hackmd.io/@hieuPenguinnn/bk-cmdb-host-search-asstdetail-cross-business-missing-authz third-party-advisory
https://github.com/TencentBlueKing/bk-cmdb product
VulnCheck Advisory: BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail third-party-advisory