What happened
CVE-2026-111682 (CVSS 6.5, CWE-862) verified via NVD REST API (published 2026-10-16 by VulnCheck): the /api/model-config REST API lacks any authorization gate, so any account with ROLE_USER can read the stored LLM provider API keys in cleartext.
Why it matters
Kafka/Lakehouse tooling increasingly stores LLM provider credentials for AI-driven monitoring and data pipelines; exposing those keys to any low-priv user creates a lateral-movement and credential-theft path against the AI infrastructure the platform connects to.
Attack vector
Authenticated low-privilege user queries /api/model-config/page or /api/model-config/{id} to retrieve unmasked LLM provider API keys due to missing authorization checks on the model-config REST API.
Affected systems
EFAK 5.0.0–5.1.0 (smartloli/EFAK)
Mitigation
Upgrade beyond 5.1.0; enforce admin-only authorization on model-config endpoints; rotate exposed LLM provider keys. See VulnCheck advisory.