CVE-2026-129129

CVSS 6.9 (medium) · published 2026-11-13

AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to query the enrichment service through Next.js console rewrite routes. Attackers can send requests to /api/v1/enrichment/lookup or /api/v1/enrichment/bulk to retrieve threat-intelligence results and set force to true to consume commercial provider API quota.

Weakness: CWE-306

Source: NVD CVE-2026-129129

References

• https://github.com/beenuar/AiSOC/blob/4d8790e21489bffdb33bdbd1ea9ea712899efaf9/apps/web/next.config.js#L305-L310
• https://github.com/beenuar/AiSOC/commit/3a853d16b09a4c59fb4fc3fbe20938bb4c306be7
• https://github.com/beenuar/AiSOC/pull/1844
• https://github.com/beenuar/AiSOC/releases/tag/v23.3.0
• https://github.com/beenuar/AiSOC/security/advisories/GHSA-qf6m-hgwv-65f9
• https://www.vulncheck.com/advisories/aisoc-12.1.0-before-23.3.0-missing-authentication-via-enrichment-console-proxy-routes

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.