何が起きたか
NVD/CVE.org は 2026-08-11 に CVE-2026-73079 (CVSS 8.5, High) を公開しました。AI API ゲートウェイのワイルドカードルーティングのパストラバーサルの欠陥について説明し、アクセ
なぜ重要か
Sub2API brokers access to shared, often high-value AI provider subscriptions (ChatGPT/Codex OAuth) across multiple tenants; a path traversal that exposes these shared credentials could allow one tenant to exhaust or hijack another's paid AI provider access or exfiltrate the operator's own OAuth tokens.
攻撃経路
The wildcard POST /responses/subpath route handling allows an authenticated tenant to path-traverse and gain access to upstream requests made with the operator's shared provider accounts, rather than being confined to their own quota/permissions.
影響を受けるシステム
Sub2API 0.1.135 to 0.1.168
緩和策
Upgrade Sub2API beyond 0.1.168; validate/canonicalize subpath routing to prevent traversal outside tenant-scoped boundaries.