adenhq Hive CVE-2026-8757

The Delete Request Handler endpoint containing the vulnerable _read_events_tail function must be network-accessible to the attacker. Exploitation requires no authentication (PR:N), no user interaction (UI:N), and no special configuration - default Hive installations exposing the routes_sessions.py endpoints are vulnerable. Exploitation is limited by the filesystem permissions of the Hive application process; attackers can only read files accessible to the user context running the Hive server. The vulnerability does not grant write access or code execution capabilities, only file read operations within the permission boundaries of the application user.

Real-world risk is elevated despite the moderate CVSS 5.5 score. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates this is remotely exploitable without authentication, privileges, or user interaction - the easiest attack scenario. The E:P (Proof-of-concept) modifier confirms publicly available exploit code exists (GitHub Gist from YLChen-007). However, impact is limited to low confidentiality/integrity/availability (VC:L/VI:L/VA:L) with no secondary scope impact (SC:N/SI:N/SA:N), suggesting file read access rather than full system compromise. The vendor's non-responsiveness is a critical red flag - no official patch exists and none may be forthcoming. EPSS and KEV data are unavailable for this recent CVE, preventing exploitation probability assessment. For organizations running internet-facing Hive instances, this represents an immediate risk due to the combination of unauthenticated network access, public exploit availability, and vendor abandonment. For internal deployments with network segmentation, risk is lower but still present from insider threats or lateral movement scenarios.

An unauthenticated attacker identifies an internet-facing adenhq Hive instance running version 0.11.0 or earlier. Using the publicly available proof-of-concept exploit (GitHub Gist ff3ff201b05d13d41f949f86e9187bd2), the attacker crafts HTTP requests to the Delete Request Handler endpoint, manipulating the _read_events_tail function with path traversal sequences like '../../../../etc/passwd' or '../../../config/database.yml'. The application fails to sanitize these inputs, allowing the attacker to read sensitive files outside the intended event logs directory, potentially exposing configuration files, credentials, API keys, or other application data, which can then be used for further attacks.