External risk intelligence

New API LLM Gateway Information Disclosure Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-64859

The product is an LLM gateway and AI asset management system, which are typically deployed as network-accessible services or APIs to facilitate interaction with external AI models and users. Such systems often function as central hubs or edge services in an infrastructure, making them commonly reachable in a deployment context.

Information Disclosure

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in an AI asset management system that serves as an LLM gateway. This issue could allow an authenticated administrator to access sensitive system configurations by obtaining the root user's credentials. The primary concern is confirming if this specific AI asset management system is in use within our environment.

Sensitive access credentials can be exposed.
Affects systems managing AI and LLM interactions.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An authenticated administrator can leverage a flaw in the user lookup API to retrieve the root user's access token. This token can then be used to access sensitive system configuration APIs, potentially leading to a complete compromise of the system.

Authenticated administrator access required.
Admin user list or user lookup API triggered.
Access to root-only configuration APIs.

Live Threat

Current exploitation, exposure, and threat context

An authenticated administrator could gain access to the root user's bearer token, potentially exposing sensitive system configuration APIs and allowing for unauthorized modifications or data access. This could occur when the affected APIs are queried, and the vulnerability is present.

Root user credentials could be exposed.
Admin user lookups could reveal sensitive tokens.
System configuration could be altered.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for the New API, likely platform or infrastructure owners, must first identify all instances of this LLM gateway and AI asset management system. Confirming its reachability and criticality is key to prioritizing remediation efforts, followed by coordinating with the system's accountable owner to plan and execute the necessary updates.

Platform or infrastructure teams own this.
Verify product reachability and business criticality.
Plan and coordinate remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is New API and how is it used?

New API is a management platform designed to orchestrate large language models (LLMs) and handle AI asset workflows. It typically acts as a centralized gateway for organizations to route, manage, and monitor interactions with various AI services, streamlining how applications connect to LLM resources.

What does CWE-200 mean for CVE-2026-64859?

CWE-200 refers to an Exposure of Sensitive Information to an Unauthorized Actor. In the context of CVE-2026-64859, this means the software accidentally includes secret data—specifically the root user's access token—inside the response sent to an administrator who is simply requesting a list of users. The system fails to filter out this sensitive credential, allowing it to leak.

How does an attacker trigger this vulnerability?

This issue is triggered when an authenticated administrator interacts with the user lookup or user list APIs, such as calling GET /api/user/. It is not triggered by standard non-administrative users or by simply browsing the public-facing parts of the application. The software mistakenly processes the user model serialization in a way that includes protected bearer tokens alongside non-sensitive profile information.

Do I need to worry if my instance is internal?

Halo Surface Signal indicates that New API is often deployed as a network-accessible service to function as a central AI hub. While external-facing instances carry higher risks, internal instances are also vulnerable if an account is compromised. You should treat the internal risk seriously because administrative access is required to exploit the flaw, and lateral movement within your network could grant an attacker that administrative level.

What is the first step to fix this?

The primary response is to upgrade your New API installation to version 1.0.0-rc.7 or later. Before applying the update, infrastructure teams should inventory all running instances of the software to verify which versions are currently active. Once identified, coordinate with the system owners to ensure a timely deployment of the patched version, which corrects the improper serialization of sensitive user tokens.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.