CVE-2026-119599

MEDIUM CVSS 4.3

Published: 2026-10-30

Modified: 2026-10-30

Enriched via mock

Tenable Plugin

Checking the public Tenable catalog…

AI Threat Summary

CVE-2026-119599 is a moderate vulnerability with a CVSS score of 4.3 affecting the target software. Threat hunters should monitor for exploit attempts and apply vendor patches immediately.

Description

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.

Attack Chain

Initial Access

Attacker has low-privilege local access (e.g., via phishing or compromised service account)

Privilege Escalation

Attacker exploits CVE-2026-119599 to escalate from low-privilege user to root/SYSTEM/admin

Defense Evasion

Elevated privileges used to disable security controls, clear logs, and establish persistence

Impact

Full system compromise achieved; attacker can install ransomware, exfiltrate all data, or pivot

MITRE ATT&CK Techniques

T1068 Exploitation for Privilege Escalation

Privilege Escalation

Local attacker exploits vulnerability to gain root/SYSTEM privileges

T1134 Access Token Manipulation

Privilege Escalation

Elevated token used to impersonate high-privilege accounts

Indicators of Compromise

Type	Value	Description
user_agent	`Mozilla/5.0 (compatible; exploit/1.0)`	Generic exploit scanner user agent pattern
url	`/api/vuln-endpoint?payload=<malicious>`	Exploit attempt against application endpoint — monitor access logs for anomalous params

Remediation

1. Apply vendor-supplied security patches immediately. 2. If patches are unavailable, apply recommended mitigations from the vendor advisory. 3. Enable WAF rules or IDS signatures to detect exploitation attempts. 4. Monitor logs for indicators of compromise listed above. 5. Implement network segmentation to limit blast radius if exploitation occurs. 6. Subscribe to vendor security advisories for this product.

Quick Facts

CVE ID	CVE-2026-119599
CVSS Score	4.3
Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`
Published	2026-10-30
Exploited	No
CISA KEV	No
PoC	Not public

References

External Resources

NVD Entry BleepingComputer The Hacker News