CVE-2026-59255: BloodHound Auth Bypass Vulnerability

CVE-2026-59255 Overview

CVE-2026-59255 is a missing authorization vulnerability [CWE-862] in BloodHound through version 9.4.0. The flaw resides in the custom-nodes API endpoints, which enforce authentication but not authorization. Any authenticated user, regardless of role, can invoke POST, PUT, and DELETE operations against /api/v2/custom-nodes to create, modify, or remove custom node kinds. Because the custom node schema is global, changes affect every user and tenant on the instance. SpecterOps fixed the issue in commit 8f79035 by requiring the OpenGraphWrite permission on state-changing routes and OpenGraphRead on read routes.

Critical Impact
Any authenticated BloodHound user can tamper with the global graph schema across all tenants, corrupting attack-path analysis data used for security decisions.

Affected Products

SpecterOps BloodHound versions up to and including 9.4.0
BloodHound Community Edition builds sharing the vulnerable cmd/api/src/api/registration/v2.go route registration
BloodHound Enterprise deployments running the affected API server prior to commit 8f79035

Discovery Timeline

2026-07-15 - CVE-2026-59255 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-59255

Vulnerability Analysis

BloodHound exposes a REST API for managing custom node kinds through the Open Graph feature. In vulnerable builds, the router in cmd/api/src/api/registration/v2.go attaches only RequireAuth() to the five custom-nodes routes. RequireAuth() validates that the caller presents a valid session token but performs no role or permission check.

The custom node kinds table is not scoped per tenant or per user. Records created through POST /api/v2/custom-nodes become part of the global graph schema. A low-privilege authenticated user can therefore issue schema mutations that every analyst on the platform will observe. Attackers can delete legitimate node kinds referenced by saved Cypher queries, causing analytical queries to return empty or incorrect results.

Root Cause

The root cause is the absence of an authorization layer between authentication and the request handler. The framework provides a RequirePermissions(permissions.OpenGraphWrite) middleware, but it was not applied to the custom-nodes routes. This is a textbook missing authorization defect classified under [CWE-862].

Attack Vector

Exploitation requires a valid BloodHound session token and network reachability to the API. The attacker sends unauthenticated schema mutations that impact all tenants. No user interaction is required, and no elevated privileges are needed beyond baseline authenticated access.

// Patch: cmd/api/src/api/registration/v2.go
// Source: https://github.com/SpecterOps/BloodHound/commit/8f790351349fd87bcb04377aba84cba6495825b3

// Vulnerable route registration (before patch)
// routerInst.GET("/api/v2/custom-nodes", resources.GetCustomNodeKinds).RequireAuth(),
// routerInst.GET(fmt.Sprintf("/api/v2/custom-nodes/{%s}", v2.CustomNodeKindParameter), resources.GetCustomNodeKind).RequireAuth(),
// routerInst.POST("/api/v2/custom-nodes", resources.CreateCustomNodeKind).RequireAuth(),
// routerInst.PUT(fmt.Sprintf("/api/v2/custom-nodes/{%s}", v2.CustomNodeKindParameter), resources.UpdateCustomNodeKind).RequireAuth(),
// routerInst.DELETE(fmt.Sprintf("/api/v2/custom-nodes/{%s}", v2.CustomNodeKindParameter), resources.DeleteCustomNodeKind).RequireAuth(),

// Fixed route registration (after patch)
routerInst.GET("/api/v2/custom-nodes", resources.GetCustomNodeKinds).RequirePermissions(permissions.OpenGraphRead),
routerInst.GET(fmt.Sprintf("/api/v2/custom-nodes/{%s}", v2.CustomNodeKindParameter), resources.GetCustomNodeKind).RequirePermissions(permissions.OpenGraphRead),
routerInst.POST("/api/v2/custom-nodes", resources.CreateCustomNodeKind).RequirePermissions(permissions.OpenGraphWrite),
routerInst.PUT(fmt.Sprintf("/api/v2/custom-nodes/{%s}", v2.CustomNodeKindParameter), resources.UpdateCustomNodeKind).RequirePermissions(permissions.OpenGraphWrite),
routerInst.DELETE(fmt.Sprintf("/api/v2/custom-nodes/{%s}", v2.CustomNodeKindParameter), resources.DeleteCustomNodeKind).RequirePermissions(permissions.OpenGraphWrite),

Source: SpecterOps BloodHound Commit 8f79035. The patch replaces RequireAuth() with RequirePermissions(permissions.OpenGraphRead) on read routes and RequirePermissions(permissions.OpenGraphWrite) on state-changing routes.

Detection Methods for CVE-2026-59255

Indicators of Compromise

Requests to POST /api/v2/custom-nodes, PUT /api/v2/custom-nodes/{id}, or DELETE /api/v2/custom-nodes/{id} originating from accounts that do not hold the OpenGraphWrite permission.
Unexpected additions, renames, or deletions in the BloodHound custom node kinds table without a corresponding change management record.
Saved Cypher queries or dashboards suddenly returning empty result sets after a schema change.

Detection Strategies

Enable API access logging on the BloodHound backend and alert on any 2xx response to POST, PUT, or DELETE under /api/v2/custom-nodes.
Correlate the authenticated principal on each custom-nodes mutation with an allowlist of administrators authorized to manage the graph schema.
Baseline the frequency of custom node kind changes; investigate deviations from the expected near-zero rate.

Monitoring Recommendations

Forward BloodHound API and reverse-proxy logs to a centralized analytics platform such as Singularity Data Lake using OCSF normalization to run detection queries at scale.
Monitor identity telemetry for BloodHound service accounts and analysts through Singularity Identity to flag session tokens issued to low-privilege users invoking schema APIs.
Track process, network, and file activity on the BloodHound host with an endpoint agent capable of behavioral analysis, such as Singularity Endpoint.

How to Mitigate CVE-2026-59255

Immediate Actions Required

Upgrade BloodHound to a build that includes commit 8f79035 or a later release addressing the custom-nodes authorization gap.
Audit the custom node kinds table for unauthorized entries and restore known-good schema definitions from backup.
Rotate all BloodHound session tokens and API keys to invalidate any credentials that may have been used for tampering.
Restrict inbound access to the BloodHound API to trusted management networks until the patch is applied.

Patch Information

The fix is committed as 8f790351349fd87bcb04377aba84cba6495825b3 under pull request #2989, tracking issue #2910. Additional context is available in the VulnCheck advisory. The patch enforces permissions.OpenGraphRead on read routes and permissions.OpenGraphWrite on create, update, and delete routes.

Workarounds

Place BloodHound behind a reverse proxy that denies POST, PUT, and DELETE methods on /api/v2/custom-nodes for non-administrator identities.
Temporarily disable the Open Graph custom-nodes feature or remove low-privilege users from the platform until upgrade is possible.
Review and reduce the number of authenticated user accounts on the BloodHound instance to the minimum required for operations.

bash

# Example: nginx snippet to block custom-nodes mutations at the proxy
location ~ ^/api/v2/custom-nodes {
    limit_except GET {
        # Allow only requests from trusted admin CIDR
        allow 10.0.0.0/24;
        deny all;
    }
    proxy_pass http://bloodhound_upstream;
}