SZB-6ac35757b0
Tencent BlueKing CMDB missing authorization exposes other businesses' hosts, EUVD-2026-114064
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Tencent BlueKing
- Product
- bk-cmdb
- First seen
Summary
The EUVD record EUVD-2026-114064 describes a missing authorization vulnerability in Tencent BlueKing CMDB (bk-cmdb) through 3.14.6, with a CVSS v3.1 score of 5.3. It says authenticated users can view hosts of other businesses through POST /api/v3/hosts/search/asstdetail.
If you use Tencent BlueKing
Upgrade bk-cmdb to a version later than 3.14.6
Restrict API access to the hosts search endpoint
Review API logs for searches across business IDs
What the sources say 1
· Mastodon: “Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail.” Source