CSGHub: an encoded parameter in a file path reads private model files

01What happened

hieuPenguinnn reported an unauthenticated private repository file read in OpenCSG's CSGHub on October 31, 2026, in a public issue on the project's GitHub repository, with a write-up on HackMD. VulnCheck published the finding as CVE-2026-120426 on November 2 and scored it 8.7. A CSGHub collaborator replied on November 1 that the team is reviewing the report and can neither confirm nor deny it yet.

02How it works

Authorization bypass through a user-controlled key is the mechanism. The CSGHub portal serves the file resolve route with no authentication guard, and for an anonymous request it fetches the file using the server-wide API key instead of a user token. On that backend call the acting identity travels as a current_user query parameter, and the portal inserts the URL's file path into the request without encoding it. A path carrying a percent-encoded query separator can therefore append its own current_user value, and the backend, seeing the service key, treats that value as the acting user.

03Who is affected

CSGHub v2.6.0-ce and earlier are the versions VulnCheck lists, and the report describes split deployments in which the portal holds a service API key. Private model, code and space repositories are reachable; dataset routes are not, because the backend requires a login for them. The researcher reviewed source code at that release tag and states that no request was executed against a live deployment.

04What to do

Require authentication in front of the portal's resolve route for non-public content until OpenCSG ships a fix, and keep CSGHub instances that hold private repositories off untrusted networks. The write-up also asks the project to stop using the service API key for user-facing file reads, to percent-encode path segments before building the backend query, and to treat a service-key current_user value as a signed assertion.

Questions people ask

Is CSGHub patched against CVE-2026-120426?

CSGHub has no fixed release for CVE-2026-120426 as of November 3, 2026. VulnCheck lists v2.6.0-ce and earlier as affected and names no fixed version, and the project's releases page shows v2.6.0-ce as the latest. OpenCSG acknowledged the report on November 1 and said it was still reviewing it, so operators have to gate the resolve route themselves.

Which CSGHub repositories can an anonymous caller read?

Private model, code and space repositories are the ones the report covers. The researcher writes that dataset routes are not affected, because the CSGHub backend requires a login for them. Exposure applies to split deployments where the portal holds a server-wide API key, and the loss is confidentiality only: the write-up claims no write access and no code execution.

How was the CSGHub flaw found and tested?

Static source review found the flaw. hieuPenguinnn read the portal's resolve handler, its download helper and the backend authenticator at tag v2.6.0-ce, and states that no request was executed against a live deployment. VulnCheck assigned CVE-2026-120426 with a CVSS v4.0 score of 8.7, while OpenCSG has not yet confirmed the behaviour on a running instance.

Sources 4 links, all fetched

1. 1vulncheck.comVulnCheck Advisory
2. 2hackmd.ioResearcher Write-Up
3. 3github.comGitHub Issue
4. 4github.comCSGHub Releases