Tencent BlueKing CMDB CVE-2026-119648

Exploitation requires a valid authenticated account on the BlueKing CMDB instance (CVSS PR:L) - it is not reachable by fully unauthenticated attackers. The specific prerequisite is access to the POST /api/v3/hosts/search/asstdetail endpoint, whose route is mapped to SkipAction so that SearchHostWithAsstDetail bypasses the AuthorizeSearchHost check; the attacker then supplies host search conditions that reference another business ID or omit the business filter. The practical limiting factors are: (1) the attacker must already hold valid credentials/session on the target instance, and (2) the flaw matters most in multi-tenant/multi-business deployments where business-level isolation is relied upon - a single-business deployment exposes no additional data. Impact is read-only: it discloses host attributes and topology associations but does not permit modification. No special non-default configuration is required beyond the vulnerable version (through 3.14.6).

This is a genuine but moderate-severity information-disclosure issue, not a high-urgency emergency. The CVSS 4.0 base score of 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) correctly captures a network-reachable, low-complexity flaw that nonetheless REQUIRES authentication (PR:L) and yields only limited confidentiality impact (VC:L) with no integrity or availability effect. The vuln.today priority is 'this_month' rather than act_now/emergency, which aligns with the absence of a CISA KEV listing and the limited, read-only impact. No EPSS score was supplied, so widespread automated exploitation cannot be quantified from the data. The reporter is VulnCheck (a credible source) and a detailed third-party technical writeup exists on HackMD, so the mechanism is well understood - the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost - but there is no input signal confirming weaponized, working exploit code. The main real-world risk is cross-business (cross-tenant) data leakage in multi-tenant CMDB deployments: any authenticated user can enumerate hosts and topology belonging to other businesses, which is a serious confidentiality/segregation breakdown for organizations relying on BlueKing's business-level isolation, even though the raw score is only medium. No conflicting signals were found between the CVSS vector and the description - both agree on network vector plus authenticated access.

A low-privileged but authenticated user of a shared BlueKing CMDB instance sends a POST request to /api/v3/hosts/search/asstdetail with search conditions that target a different business ID, or that omit the business filter entirely. Because the endpoint skips the AuthorizeSearchHost check, the server returns host attributes and topology association details for businesses the user has no rights to, enabling cross-tenant reconnaissance. A detailed public technical writeup of the flaw exists (HackMD), but the input does not confirm a verified working exploit tool.