{"id":8909,"date":"2026-11-13T21:24:02","date_gmt":"2026-11-13T21:24:02","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys"},"modified":"2026-11-13T21:24:02","modified_gmt":"2026-11-13T21:24:02","slug":"cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys","title":{"rendered":"CVE-2026-68905: Hugo Blog AI Proxy Exposes API Keys Without Authentication"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> Three AI proxy endpoints in Hugo Blog accept unauthenticated requests and forward them to upstream LLM services using the operator&#8217;s API key<\/li><li><strong>Who is affected:<\/strong> Operators who deploy Hugo Blog following the documented Nginx reverse-proxy setup with AI assistant features enabled<\/li><li><strong>Severity:<\/strong> CVSS 8.2 (High), enables unlimited quota consumption and cost exhaustion<\/li><li><strong>Status:<\/strong> No patch available at time of publication (commit 744ca15 and prior affected)<\/li><li><strong>What to do:<\/strong> Disable public access to \/api\/blog-assistant, \/api\/blog-search-embedding, and \/api\/blog-search-rerank endpoints until a patch is released<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A tech blog platform called Hugo Blog has a feature that lets visitors ask questions to an AI assistant. The code that handles these AI requests does not check who is making the request. Anyone on the internet can send requests that get forwarded to OpenAI or similar services, and the blog owner&#8217;s API key pays for every request. An attacker can run up the blog owner&#8217;s bill or use up their entire monthly quota, making the AI assistant stop working for real visitors. If you run a Hugo Blog site with the AI assistant turned on, you should block public access to those three API endpoints right away. If you just read blogs and do not run one yourself, this does not affect you.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The AI assistant proxy in lanshi17\/hugo_blog contains a missing authentication vulnerability in the file <code>server\/ai-assistant-proxy.mjs<\/code>. The route gate at line 249 checks only the HTTP method and path for three endpoints: <code>POST \/api\/blog-assistant<\/code>, <code>POST \/api\/blog-search-embedding<\/code>, and <code>POST \/api\/blog-search-rerank<\/code>. No authentication or authorization logic follows this check.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After the route check, the proxy parses the request body at line 258 and forwards the attacker-controlled payload to the upstream LLM, embedding, or rerank service at lines 368 to 380. The <code>requestUpstream()<\/code> function at lines 118 to 125 unconditionally attaches the operator&#8217;s server-side API key (<code>OPENAI_API_KEY<\/code> or <code>AI_SEARCH_API_KEY<\/code>) in the <code>Authorization: Bearer<\/code> header.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The default CORS configuration sets <code>ALLOWED_ORIGIN<\/code> to <code>*<\/code> (line 15), meaning any cross-origin browser-based attacker can also exploit the vulnerability. The documented deployment path in <code>docs\/ai-assistant-openai-compatible.md<\/code> (lines 36 to 38) instructs operators to set <code>OPENAI_API_KEY<\/code> server-side, run <code>npm run ai-proxy<\/code>, and expose <code>\/api\/*<\/code> publicly via Nginx (<code>docs\/ai-assistant-nginx.example.conf<\/code> lines 4 to 5 and 18 to 30). This makes the vulnerability present in the default documented deployment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A proof-of-concept using Docker demonstrates that an unauthenticated HTTP POST to <code>http:\/\/127.0.0.1:18787\/api\/blog-assistant<\/code> returns HTTP 200, includes <code>Access-Control-Allow-Origin: *<\/code>, and causes the mock upstream to log receipt of the server API key <code>Bearer sk-test-secret<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Operators who have deployed Hugo Blog with the AI assistant proxy should immediately restrict public access to the three affected endpoints: <code>\/api\/blog-assistant<\/code>, <code>\/api\/blog-search-embedding<\/code>, and <code>\/api\/blog-search-rerank<\/code>. This can be done by modifying the Nginx configuration to require authentication or by blocking these paths entirely until a patch is released.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Monitor API usage and billing dashboards for unexpected spikes in LLM, embedding, or rerank API calls. Review server logs for POST requests to the three endpoints from unfamiliar IP addresses or user agents.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is a CWE-306 (Missing Authentication for Critical Function) vulnerability. Any unauthenticated remote user on the internet can call the three AI proxy endpoints and cause the server to consume the operator&#8217;s LLM, embedding, or rerank API quota on their behalf.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Operators who deploy the blog following the documented Nginx reverse-proxy guide bear the full financial cost of the attacker&#8217;s LLM calls and may face sudden quota exhaustion or service disruption. End users of the blog will find the AI assistant unavailable if the operator&#8217;s API key is exhausted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Attack scenarios include automated scripts sending high volumes of requests to exhaust API quota (Availability impact rated High in the advisory) and indirect financial damage from unbounded LLM API billing. Cross-origin browser-based abuse is also possible due to the <code>Access-Control-Allow-Origin: *<\/code> default (Integrity impact rated Low). The vulnerability is exploitable with zero prior access and no credentials.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/github.com\/lanshi17\/hugo_blog\/security\/advisories\/GHSA-pj75-r769-qjv2\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Security Advisory GHSA-pj75-r769-qjv2<\/a><\/li><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-68905\" target=\"_blank\" rel=\"noreferrer noopener\">NVD CVE-2026-68905<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>The AI assistant proxy in lanshi17\/hugo_blog exposes three HTTP endpoints without authentication, allowing any remote attacker to consume the operator&#8217;s LLM API quota using the server-side API key.<\/p>\n","protected":false},"author":2,"featured_media":8908,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"high","_nx_sec_affected":"Hugo Blog commit 744ca15 and prior","_nx_sec_status":"no-fix-yet","_nx_sec_kicker":"URGENT: Unauthenticated AI Proxy Drains API Quota","_nx_sec_type":"platform","_nx_sec_vendor":"Hugo Blog","_nx_sec_fixed":"","_nx_sec_action":"Block public access to \/api\/blog-assistant, \/api\/blog-search-embedding, \/api\/blog-search-rerank"},"categories":[65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8909","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-68905: Hugo Blog AI Proxy Key Exposure<\/title>\n<meta name=\"description\" content=\"CVE-2026-68905 in Hugo Blog AI assistant proxy allows unauthenticated attackers to abuse server-side API keys, causing unlimited quota consumption.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-68905: Hugo Blog AI Proxy Key Exposure\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-68905 in Hugo Blog AI assistant proxy allows unauthenticated attackers to abuse server-side API keys, causing unlimited quota consumption.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-13T21:24:02+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-68905: Hugo Blog AI Proxy Exposes API Keys Without Authentication\",\"datePublished\":\"2026-11-13T21:24:02+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys\"},\"wordCount\":634,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys-title.webp\",\"articleSection\":[\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-13T21:24:02+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys\",\"name\":\"CVE-2026-68905: Hugo Blog AI Proxy Key Exposure\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys-title.webp\",\"datePublished\":\"2026-11-13T21:24:02+00:00\",\"description\":\"CVE-2026-68905 in Hugo Blog AI assistant proxy allows unauthenticated attackers to abuse server-side API keys, causing unlimited quota consumption.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-68905: Hugo Blog AI Proxy Exposes API Keys Without Authentication\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-68905: Hugo Blog AI Proxy Key Exposure","description":"CVE-2026-68905 in Hugo Blog AI assistant proxy allows unauthenticated attackers to abuse server-side API keys, causing unlimited quota consumption.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-68905: Hugo Blog AI Proxy Key Exposure","og_description":"CVE-2026-68905 in Hugo Blog AI assistant proxy allows unauthenticated attackers to abuse server-side API keys, causing unlimited quota consumption.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys","og_site_name":"i10X News","article_published_time":"2026-11-13T21:24:02+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-68905: Hugo Blog AI Proxy Exposes API Keys Without Authentication","datePublished":"2026-11-13T21:24:02+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys"},"wordCount":634,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys-title.webp","articleSection":["AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-13T21:24:02+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys","name":"CVE-2026-68905: Hugo Blog AI Proxy Key Exposure","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys-title.webp","datePublished":"2026-11-13T21:24:02+00:00","description":"CVE-2026-68905 in Hugo Blog AI assistant proxy allows unauthenticated attackers to abuse server-side API keys, causing unlimited quota consumption.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-68905-hugo-blog-ai-proxy-exposes-api-keys#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-68905: Hugo Blog AI Proxy Exposes API Keys Without Authentication"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8909"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8909\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8908"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8909"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8909"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}