Is CVE-2026-64859 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64859 being exploited in the wild.

How severe is CVE-2026-64859?

Critical severity, with a CVSS score of 9.1, published 17 August 2026.

Which products and versions are affected?

github.com/QuantumNous/new-api (Go) < 1.0.0-rc.7, SEMVER:introduced=0,fixed=1.0.0-rc.7; QuantumNous New API before v1.0.0-rc.7.

Is there a fix for CVE-2026-64859?

Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64859 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-64859?

Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64859: New API user list API information disclosure and privilege escalation

Q: Is there a fix for CVE-2026-64859?

Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-64859 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-64859?

Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64859 · Severity: critical · CVSS 9.1 · Published 2026-08-17

new-api is an API management platform used to handle user accounts and system configuration. Affected versions leak API authentication tokens for admin and root users through user lookup endpoints, allowing an authenticated admin to impersonate the root user and gain unrestricted access to sensitive system settings, payment configuration, and other administrative functions. This represents a complete bypass of intended access control and requires immediate upgrade to patch.

Technologies: github.com/QuantumNous/new-api (Go), QuantumNous New API. Vendors: Go, QuantumNous.

Quick answers

Is CVE-2026-64859 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64859 being exploited in the wild.
How severe is CVE-2026-64859?: Critical severity, with a CVSS score of 9.1, published 17 August 2026.
Which products and versions are affected?: github.com/QuantumNous/new-api (Go) < 1.0.0-rc.7, SEMVER:introduced=0,fixed=1.0.0-rc.7; QuantumNous New API before v1.0.0-rc.7.
Is there a fix for CVE-2026-64859?: Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64859 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-64859?: Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.7 or later
```
go get github.com/QuantumNous/new-api@v1.0.0-rc.7
```

Technical details

The vulnerability is an information disclosure and privilege escalation in the user management APIs of new-api. The root cause is improper JSON serialization: the User.AccessToken field was tagged with json:"access_token", causing access tokens to be serialized in API responses. User list, search, and detail endpoints returned User model objects with only the password field omitted (via Omit("password")), leaving access_token unfiltered. An authenticated admin user can call GET /api/user/ to retrieve user records containing access tokens for other users, including the root user. Because access tokens serve as bearer credentials for API authentication, obtaining the root user's token allows the attacker to authenticate as root and access root-only endpoints for system configuration, payment settings, and OAuth/SMTP configuration. The fix (available in v1.0.0-rc.7) changes the field tag to json:"-" to prevent serialization.

Affected products

QuantumNous new-api before v1.0.0-rc.7

Identifiers

CVE-2026-64859
GHSA-6x2c-phff-wx57
GO-2026-6240

Timeline

2026-07-03: disclosed
2026-08-17: advisory: GitHub Advisory Database published
2026-07-03: patched: Fixed in v1.0.0-rc.7 (commit 0936e25)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.