Executive brief
An API endpoint in a backend service accepts user-supplied input and uses it directly in requests to an underlying analytics data store without validation. An authenticated attacker can exploit this to redirect requests to unintended internal endpoints, bypassing access controls and exposing sensitive configuration and administrative data that should be restricted. This could compromise data confidentiality and enable lateral movement within internal systems.
Technical details
The vulnerability is a path traversal or parameter injection flaw in an API endpoint that constructs backend data store requests using unsanitized user input. An authenticated attacker can inject arbitrary path components into the interpolated request, causing the application's own elevated service credentials to be used against unintended internal endpoints. The attack requires authentication but no additional preconditions; the attacker gains the ability to enumerate and read restricted internal configuration and administrative data from the backend data store that would otherwise be access-controlled. No patch information is currently available.
Timeline
- 2026-09-11: disclosed