CVE-2026-119648 BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119648?
CVE-2026-119648 is a medium-severity vulnerability in TencentBlueKing bk-cmdb, published on 30 Oct 2026.
Official description
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.
Weakness: CWE-862
Which versions are affected by CVE-2026-119648?
How do I fix CVE-2026-119648?
No fix has been published for CVE-2026-119648 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119648 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119648 exists.
Sources
Also known as GHSA-5q24-jq83-qh8q.