Sub2API EUVD-2026-56237

Exploitation requires a valid tenant API key issued by a Sub2API operator running versions 0.1.135-0.1.168 - unauthenticated exploitation is not possible (CVSS PR:L). The attacker must be an enrolled tenant on the targeted platform; there is no guest or anonymous path to exploitation. The upstream impact scope depends on operator configuration: deployments using ChatGPT/Codex OAuth or OpenAI platform keys expose those credentials to relay abuse; deployments using an operator-configured base URL expose whatever service resides at that URL. No non-default configuration is required beyond a standard tenant deployment - the vulnerable wildcard route is a core gateway feature, not an optional one. Exploitation is limited by the fact that raw credential values cannot be exfiltrated; the attacker can only make upstream requests as the operator identity, and all such requests still traverse the operator's upstream account, creating an audit trail.

The CVSS 8.5 score with S:C accurately reflects that exploitation escapes the Sub2API trust boundary: the attacker does not merely affect the gateway but uses operator-owned upstream provider credentials to reach external AI provider APIs. The attack requires only low privilege (a valid tenant account, PR:L) and no special complexity (AC:L), making it straightforward for any enrolled tenant. No EPSS score was supplied in the input data, so exploitation probability cannot be independently quantified. There is no CISA KEV listing and no confirmed public exploit code; however, the GitHub security advisory, the PR diff with explicit test vectors (e.g., /v1/responses/../../x/y, /v1/responses/..%2f..%2fx/y), and the release tag are all publicly accessible - meaning any authenticated tenant can reconstruct a working exploit with minimal effort. The primary real-world risk is credential relay abuse: tenants can consume operator quota, access gated models, or trigger upstream provider operations using the operator's account identity. The impact is bounded by the fact that raw credential values cannot be extracted, only abused to make upstream requests.

An authenticated tenant on a Sub2API deployment running versions 0.1.135-0.1.168 sends a POST request to /v1/responses/../../arbitrary/upstream/endpoint using their issued tenant API key. The gateway, performing no subpath validation, constructs an upstream URL that resolves outside the intended AI provider response prefix and forwards the request using the operator's pooled credentials. The tenant effectively acts as the operator on the upstream provider, potentially consuming quota, invoking restricted model endpoints, or triggering account-level operations on the operator's provider account.