{"vulnerability": "cve-2026-108581", "sightings": [{"uuid": "ab5fa45b-7a87-4ebf-854c-4f9504676781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108581", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117417451861239911", "content": "CVE-2026-108581 Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain plaintext LLM and voice provider API keys and abuse the upstream provider accounts.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108581https://github.com/TencentCloud/Octop/pull/1507https://github.com/TencentCloud/Octop/pull/1265https://hackmd.io/@haind/octop-provider-key-cross-role-readhttps://github.com/TencentCloud/Octop/blob/eb28011249c02cafd389b2d424294c6c1b9cf422/src/octop/api/routers/providers.py#L120-L208https://www.vulncheck.com/advisories/octop-through-1.0-2b6-missing-authorization-exposes-provider-api-keys-via-api-providers#TencentCloud #Octop#CVE_2026_108581#bot", "creation_timestamp": "2026-10-10T16:02:10.788201Z"}]}