Tools AI Risk Radar ai-incident-0199
Incident record
OpenLIT can expose another project’s model traces
- Severity
- Medium
- Status
- Research
- Type
- Infra Vuln
- Target
- OpenLIT 2.1.0; researcher also describes the current session-authentication path
- Actor
- researcher
- CVE
- CVE-2026-108596
What happened
An authenticated OpenLIT user can supply another project’s identifier and database-configuration identifier to read that project’s telemetry, which may include model inputs and outputs.
The CVE was published on 10 October; the original researcher publication date is unconfirmed. The report requires a shared deployment and knowledge of both target identifiers. A separate API-key variant was closed on the development branch; the described session path remained affected. The CNA gives CVSS 3.1 score 5.3. Patch status remains unconfirmed as of 11 October.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-108596
- Researcher disclosurehackmd.io/@haind/openlit-project-context-read
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026