CVE-2026-73079: Sub2API Path Traversal Vulnerability

CVE-2026-73079 Overview

CVE-2026-73079 is a path traversal vulnerability [CWE-22] in Sub2API, an AI API gateway platform that distributes and manages API quotas from AI product subscriptions. The flaw affects versions 0.1.135 through 0.1.168. The POST /responses/*subpath wildcard routes concatenate client-supplied subpaths into upstream URLs without validation. Authenticated tenants can relay arbitrary requests to upstream endpoints using pooled operator credentials, including ChatGPT/Codex OAuth tokens and OpenAI platform keys. The vulnerability is fixed in version 0.1.169.

Critical Impact
Authenticated tenants can abuse pooled provider credentials (ChatGPT OAuth, OpenAI keys) to reach arbitrary upstream endpoints, exposing operator accounts to unauthorized API consumption and data exfiltration.

Affected Products

Sub2API versions 0.1.135 through 0.1.168
Deployments using pooled ChatGPT/Codex OAuth credentials
Deployments using OpenAI platform keys or operator-configured base URLs

Discovery Timeline

2026-08-11 - CVE-2026-73079 published to NVD
2026-08-11 - Last updated in NVD database
v0.1.169 - Sub2API releases patched version

Technical Details for CVE-2026-73079

Vulnerability Analysis

Sub2API acts as a gateway that maps tenant-issued API keys onto pooled upstream credentials owned by the operator. The gateway exposes wildcard routes of the form POST /responses/*subpath that forward requests to configured upstream providers.

The handler spliced the client-supplied *subpath value directly into the upstream URL path without sanitization. Because the wildcard segment could contain traversal sequences and arbitrary path components, an authenticated tenant could steer requests to endpoints outside the intended /responses/ namespace. The upstream request still carried the operator's pooled credentials.

This converts the gateway into a confused deputy. The tenant's API key authorizes access to the gateway, but the outbound HTTP call uses shared ChatGPT OAuth tokens, OpenAI platform keys, or credentials tied to an operator-configured base URL.

Root Cause

The root cause is missing validation of URL path segments supplied by callers. Wildcard route parameters were treated as opaque strings and appended to trusted upstream base URLs. No checks rejected traversal tokens such as . and .., control characters, or segments that changed the URL's authority or path scope.

Attack Vector

An attacker authenticates to Sub2API using any valid tenant API key. The attacker then issues a POST /responses/<crafted-subpath> request where <crafted-subpath> contains path traversal characters or arbitrary path components. The gateway forwards the request upstream using pooled credentials, allowing the attacker to consume operator quota or invoke endpoints the tenant should not access.

// Patch: backend/internal/handler/gemini_v1beta_handler.go
// Source: https://github.com/Wei-Shaw/sub2api/commit/017f6bbd5edffea0639ef3c84c0391161983f1f3

		googleError(c, http.StatusBadRequest, "Missing model in URL")
		return
	}
+	// 模型名会被拼进上游 URL 的 path，先在入口校验片段合规性，
+	// 见 service/upstream_path_guard.go。
+	if !service.IsSafeGeminiModelPathSegment(modelName) {
+		googleError(c, http.StatusBadRequest, "Invalid model in URL")
+		return
+	}
	if resolvedModel, ok := service.ResolvedUpstreamModelFromContext(c.Request.Context()); ok && strings.TrimSpace(resolvedModel) != "" {
		modelName = strings.TrimSpace(resolvedModel)
	}

// Patch: backend/internal/pkg/xai/oauth.go
// Source: https://github.com/Wei-Shaw/sub2api/commit/017f6bbd5edffea0639ef3c84c0391161983f1f3

	if requestID == "" {
		return "", fmt.Errorf("request id is required")
	}
+	// requestID 由客户端提供并拼进上游 URL 的 path。PathEscape 之外再要求它不是
+	// 纯点片段、不含控制字符，保证它只能是一个普通的路径片段。
+	if requestID == "." || requestID == ".." || strings.ContainsAny(requestID, "\\x00\r\n") {
+		return "", fmt.Errorf("invalid request id")
+	}
	return validatedBaseURL + "/videos/" + url.PathEscape(requestID), nil
}

The patch introduces IsSafeGeminiModelPathSegment and rejects ., .., and control characters before appending caller input to upstream URLs.

Detection Methods for CVE-2026-73079

Indicators of Compromise

Requests to POST /responses/* containing .., encoded traversal sequences (%2e%2e), or unexpected path depth beyond the standard responses namespace.
Outbound upstream calls from the gateway to endpoints outside the configured provider API surface.
Anomalous spikes in pooled OAuth or OpenAI platform key usage that do not correlate with tenant quota accounting.

Detection Strategies

Inspect gateway access logs for tenant requests whose *subpath parameter contains ., .., null bytes, \r, or \n.
Correlate tenant identifiers with upstream URL paths to identify callers whose subpath diverges from expected model or endpoint names.
Compare Sub2API upstream request logs against provider-side audit logs for OAuth tokens and platform keys to surface mismatches.

Monitoring Recommendations

Alert on any Sub2API request where the resolved upstream URL falls outside an allowlist of expected provider paths.
Monitor rate and volume of upstream calls per pooled credential and flag deviations tied to specific tenants.
Track HTTP 4xx and 5xx responses from upstream providers for patterns consistent with probing arbitrary endpoints.

How to Mitigate CVE-2026-73079

Immediate Actions Required

Upgrade Sub2API to version 0.1.169 or later, which enforces path segment validation.
Rotate all pooled upstream credentials including ChatGPT/Codex OAuth tokens and OpenAI platform keys after upgrading.
Audit gateway logs from the exposure window for requests containing traversal characters in *subpath parameters.

Patch Information

The fix is available in Sub2API v0.1.169. Technical details are documented in GitHub Security Advisory GHSA-vrxq-qm4h-6hgg, the remediation pull request #5137, and the upstream path guard commit. The patch introduces path segment validators that reject ., .., and control characters before subpaths are joined to upstream URLs.

Workarounds

Place a reverse proxy in front of Sub2API that rejects requests to /responses/ containing .., encoded traversal, or control characters.
Restrict tenant API keys to the minimum required scope and revoke unused keys until the upgrade is complete.
Disable operator-configured base URL routing until deployment is upgraded to 0.1.169.

bash

# Verify running Sub2API version and upgrade
docker inspect sub2api --format '{{.Config.Image}}'
docker pull ghcr.io/wei-shaw/sub2api:v0.1.169
docker stop sub2api && docker rm sub2api
docker run -d --name sub2api ghcr.io/wei-shaw/sub2api:v0.1.169