HIGH 7.1 NVD
CVE-2026-110208
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stor
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
References
- https://github.com/WuKongOpenSource/Wukong-AICRM
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/k
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/k
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/k
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/k
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-13 via NVD.
vulnfeed aggregates 14602 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.