Answer in brief
CVE-2026-68905 records a High severity (CVSS 8.2) vulnerability in Hugo Blog: Unauthenticated AI Proxy Allows Abuse of Server-Side API Key. The current sources do not mark it as known exploited. The current feed maps lanshi17/hugo_blog (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps lanshi17/hugo_blog (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| lanshi17/hugo_bloggeneric | <=744ca1563032e8a881390d3ed55d9a3ef2928502 | = 744ca1563032e8a881390d3ed55d9a3ef2928502 |
Published upstream
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 13, 2026
Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints (POST /api/blog-assistant, POST /api/blog-search-embedding, POST /api/blog-search-rerank) without any authentication check. When deployed following the documented Nginx reverse-proxy setup, any unauthenticated remote attacker can send arbitrary requests that the proxy forwards to the upstream LLM/embedding/rerank API using the operator's server-side API key (OPENAI_API_KEY / AI_SEARCH_API_KEY). This enables unlimited quota consumption, cost exhaustion, and potential service unavailability for the operator. At time of publication, there are no publicly available patches.
Quoted source text, attributed separately from HOL analysis.