QuantumNous new-api CVE-2026-9306

Exploitation requires the target new-api deployment to have Midjourney image relay functionality enabled and exposed (relay-router.go endpoints active). The high attack complexity (AC:H) rating indicates specific non-trivial conditions: likely requires knowledge of valid Midjourney image identifiers (MJId values), understanding of the API's image retrieval parameter structure, or exploitation of race conditions/timing windows in the authorization check logic. No authentication required (PR:N) means any network-accessible attacker can attempt exploitation. No user interaction needed (UI:N). The CWE-639 classification (authorization bypass through user-controlled key) suggests attackers must manipulate image identifier parameters in a specific way that bypasses authorization checks. Limiting factors include the high complexity barrier (not point-and-click exploitation despite POC availability) and impact limited to confidentiality breach of Midjourney images rather than broader system access. Organizations not using Midjourney integration features are not affected even if running vulnerable versions.

Real-world risk assessment presents conflicting signals requiring careful interpretation. The CVSS 3.1 base score of 3.7 (Low severity) reflects high attack complexity (AC:H), no privileges required (PR:N), network accessibility (AV:N), and confidentiality impact only (C:L/I:N/A:N). The Exploitability metric (E:P) confirms proof-of-concept code exists. However, the 'difficult exploitability' descriptor and AC:H rating suggest successful exploitation requires specific timing, race conditions, or non-trivial manipulation techniques. The confidentiality impact is limited to low, indicating potential exposure of Midjourney-generated images rather than system compromise. Critical risk factors include: publicly available exploit code (GitHub Gist), unauthenticated remote vector, and vendor non-responsiveness indicating no official patch timeline. Mitigating factors: high attack complexity suggests this is not mass-exploitable, and impact is limited to information disclosure without integrity or availability effects. Organizations using new-api specifically for Midjourney image relay should prioritize this; others may deprioritize given the narrow functional scope and low CVSS. EPSS score not provided prevents quantitative exploitation likelihood assessment. No CISA KEV listing confirms this is not observed in widespread active exploitation.

An external attacker identifies a QuantumNous new-api instance exposing Midjourney image relay endpoints. Using the publicly available proof-of-concept from GitHub (https://gist.github.com/YLChen-007/13974ead25fc6dac42fd7bac62fbb2df), the attacker crafts HTTP requests that manipulate the GetByOnlyMJId function parameter to retrieve Midjourney-generated images without authorization. Despite high attack complexity suggesting timing dependencies or specific parameter combinations, the attacker iterates through potential image identifiers or exploits predictable ID patterns to access confidential image content generated by legitimate users, potentially exposing proprietary designs, internal communications visualized through AI, or other sensitive visual data.