CVE-2026-73079

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73079
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73079.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73079
Aliases
  • GHSA-vrxq-qm4h-6hgg
Published
2026-08-11T15:54:00.165Z
Modified
2026-08-13T04:03:03.571503084Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials
Details

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts (ChatGPT/Codex OAuth, OpenAI platform keys, or an operator-configured base URL) that belong to the operator, not to the caller. The POST /responses/*subpath wildcard routes spliced the client-supplied subpath into the upstream URL with no validation. This lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials via a path traversal. This vulnerability is fixed in 0.1.169.

Database specific 
{
    "cwe_ids": [
        "CWE-22",
        "CWE-441"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73079.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/wei-shaw/sub2api

Affected ranges

Type
GIT
Repo
https://github.com/wei-shaw/sub2api
Events
Introduced
8c782bcc81bd0661aeaf8da74499005c251c2925
Fixed
017f6bbd5edffea0639ef3c84c0391161983f1f3
Fixed
26d894ef4f50645a4bf1030e378ac892f17d0223
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.1.135"
        },
        {
            "fixed": "0.1.169"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.135
v0.1.136
v0.1.137
v0.1.138
v0.1.139
v0.1.140
v0.1.141
v0.1.142
v0.1.143
v0.1.144
v0.1.145
v0.1.146
v0.1.147
v0.1.149
v0.1.150
v0.1.151
v0.1.152
v0.1.153
v0.1.155
v0.1.156
v0.1.157
v0.1.158
v0.1.159
v0.1.160
v0.1.161
v0.1.162
v0.1.163
v0.1.164
v0.1.165
v0.1.166
v0.1.168

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73079.json"