{"affected":[{"product":"hugo_blog","source":"CNA: GitHub_M","vendor":"lanshi17","versions":[{"status":"affected","version":"<= 744ca1563032e8a881390d3ed55d9a3ef2928502"}]}],"cveId":"CVE-2026-68905","cwes":["CWE-306"],"description":"Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints (POST /api/blog-assistant, POST /api/blog-search-embedding, POST /api/blog-search-rerank) without any authentication check. When deployed following the documented Nginx reverse-proxy setup, any unauthenticated remote attacker can send arbitrary requests that the proxy forwards to the upstream LLM/embedding/rerank API using the operator's server-side API key (OPENAI_API_KEY / AI_SEARCH_API_KEY). This enables unlimited quota consumption, cost exhaustion, and potential service unavailability for the operator. At time of publication, there are no publicly available patches.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"}],"modifiedAt":1794597686887,"publishedAt":1794597686887,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/lanshi17/hugo_blog/security/advisories/GHSA-pj75-r769-qjv2"}],"remediation":[],"revision":"8e4ecefdf2bd9dd343ec8e689fe042136628e54a292afd10db2676366056ff83","sources":[{"modifiedAt":1794597686887,"name":"CNA: GitHub_M","retrievedAt":1794600620065,"url":"https://www.cve.org/CVERecord?id=CVE-2026-68905"}],"ssvc":null,"status":"published","title":"Hugo Blog: Unauthenticated AI Proxy Allows Abuse of Server-Side API Key","updatedAt":1794600620065}