CVE-2026-108711
Description
A flaw was found in honcho. An improper authorization vulnerability allows authenticated attackers with restricted API (Application Programming Interface) keys to obtain sensitive workspace data, leading to information disclosure. By submitting a parent workspace name to the workspace creation endpoint, an attacker can bypass access control checks that fail to validate key permissions. This flaw exposes workspace configuration instructions and metadata normally reserved for administrators.
Statement
This vulnerability is rated as having Moderate impact for Red Hat environments because exploitation requires valid, authenticated credentials and results solely in limited confidentiality impact without data modification or privilege escalation beyond the application layer. The affected Honcho service is not shipped or enabled by default across Red Hat product offerings. Exposure is therefore restricted to individual customer deployments running this third-party AI memory framework.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
