CVE-2026-68905

Name of the Vulnerable Software and Affected Versions Hugo Blog versions prior to commit 744ca15

Description The AI assistant proxy lacks authentication checks for three HTTP endpoints: "POST /api/blog-assistant", "POST /api/blog-search-embedding", and "POST /api/blog-search-rerank". When using the documented Nginx reverse-proxy setup, unauthenticated remote attackers can send arbitrary requests that the proxy forwards to upstream LLM, embedding, or rerank APIs. These requests utilize the operator's server-side API keys OPENAI API KEY and AI SEARCH API KEY, which can lead to unlimited quota consumption, cost exhaustion, and service unavailability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.