Executive brief
one-api is an LLM API management and redistribution system that allows operators to configure multiple AI provider channels. A low-privilege user can bypass channel access controls and role-based restrictions by specifying an arbitrary channel ID in the URL, forcing the server to make requests using operator-configured API keys the user was never granted access to. This bypasses both per-group channel restrictions and model allowlists, potentially exposing sensitive provider credentials and enabling unauthorized API usage.
Technical details
The vulnerability is an authorization bypass in the channel-pinning logic (middleware/auth.go). The application provides two paths to select a channel: a suffix-based path restricted to admin users (model.IsAdmin), and a URL path parameter (/channelid) that bypasses all role checks. Any authenticated user holding a valid API token can inject an arbitrary channel ID via the URL parameter without permission validation. The distributor component loads the channel by integer identifier with no scoping to the caller's user or group, then substitutes the channel's stored provider key into the upstream Authorization header and routes the request to that channel's base URL. No patch availability is explicitly stated in the advisory.
Affected products
- songquanpeng one-api v0.6.10 and likely earlier versions
Timeline
- 2026-08-26: disclosed: CVE-2026-81027 published on NVD