Tools AI Risk Radar ai-incident-0207
Incident record
Octop exposes stored provider keys to authenticated users
- Severity
- Medium
- Status
- Research
- Type
- Infra Vuln
- Target
- TencentCloud Octop through 1.0.2b6
- Actor
- researcher
- CVE
- CVE-2026-108581
What happened
Any authenticated Octop user can read administrator-configured model and voice-provider API keys through provider-listing responses.
A public security pull request described the issue on 28 September; the CVE was published on 10 October. The CNA gives CVSS 3.1 score 6.5. The focused masking fix, pull request 1507, remained open and unmerged when checked on 11 October. The earlier combined pull request 1265 was closed without merging.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-108581
- Researcher disclosurehackmd.io/@haind/octop-provider-key-cross-role-read
- Proposed provider-key fixgithub.com/TencentCloud/Octop/pull/1507
- Earlier public security reportgithub.com/TencentCloud/Octop/pull/1265
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026