CVE-2026-73079

Name of the Vulnerable Software and Affected Versions Sub2API versions 0.1.135 through 0.1.168

Description Sub2API is an AI API gateway platform that manages API quotas from AI product subscriptions. An issue exists where platform API keys issued to tenants are exchanged for upstream requests using shared provider accounts belonging to the operator. The POST /responses/*subpath endpoint fails to validate the client-supplied subpath when splicing it into the upstream URL. This allows an authenticated tenant to perform a path traversal, relaying requests to arbitrary upstream endpoints using the operator's pooled account credentials.

Recommendations Update Sub2API to version 0.1.169.