SZB-6ff429ad6c
AxonHub privilege escalation via unvalidated API key scopes (EUVD-2026-113936)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- looplj
- Product
- AxonHub
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a privilege escalation vulnerability in AxonHub through 1.0.0-beta11, scored 5.3/10 (CVSS v3.1). According to the entry, project users can assign system-level scopes by creating service_account API keys with unvalidated scopes.
If you use looplj
Upgrade AxonHub beyond 1.0.0-beta11 once a fix is released
Limit which users hold write_api_keys permission
Audit existing service_account API keys for unexpected scopes
What the sources say 1
· Mastodon: “AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes.” Source