CVE-2026-119648

MediumCVSS 4.3

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

22th percentile - higher than 22% of all known CVEs

Summary

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. An attacker can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.

Risk Assessment

An attacker can obtain information about other businesses' hosts and topology, breaching tenant data isolation and disclosing infrastructure details. Only an authenticated account is required.

Recommendation

Upgrade bk-cmdb to a version later than 3.14.6. Remove the route mapping to SkipAction and ensure AuthorizeSearchHost is invoked in SearchHostWithAsstDetail.

Other vulnerabilities in Tencent BlueKing CMDB

CVE-2024-22873High
An SSRF vulnerability in Tencent Blueking CMDB versions 3.2.x to 3.9.x allows attackers to make internal requests via the event subscription function. Exploitation is possible through a crafted POST request to the /service/subscription.go endpoint.

Original NVD description (English source)

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS