CVE-2026-81027: one-api Auth Bypass Vulnerability

CVE-2026-81027 Overview

CVE-2026-81027 is a missing authorization vulnerability [CWE-862] in one-api through version 0.6.10. The flaw lets any authenticated low-privilege token holder pin an arbitrary upstream channel by supplying its integer identifier in a URL path parameter. The server then issues requests to the selected channel using an operator-configured provider API key, bypassing per-group restrictions and the channel's model allowlist.

Critical Impact
Any account with a valid API token can enumerate and abuse upstream provider credentials configured by administrators, exhausting quotas and gaining access to models the account was never authorized to use.

Affected Products

one-api through v0.6.10
Deployments exposing the token-authenticated route accepting the channelid path parameter
Multi-tenant one-api installations sharing operator-managed upstream provider keys

Discovery Timeline

2026-08-26 - CVE-2026-81027 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-81027

Vulnerability Analysis

The issue lives in middleware/auth.go, which offers two ways for a caller to select a specific upstream channel. The first path parses a suffix on the API key and only proceeds after model.IsAdmin confirms the caller has administrator privileges. The second path reads the channel identifier from c.Param("channelid") and performs no role check whatsoever.

Because the route carrying the channelid parameter sits behind token authentication only, any account holding a valid API token can reach it. The selected value flows into the distributor, which loads the channel by integer identifier without scoping the lookup to the caller's user or group. The distributor then sets the outbound Authorization header to the channel's stored key and directs the request at the channel's base URL.

Root Cause

The root cause is inconsistent enforcement between two authorization branches that reach the same sensitive sink. Only the API-key suffix branch is gated by model.IsAdmin; the path-parameter branch inherits no equivalent check. This asymmetry defeats the channel abstraction, which is intended to keep upstream provider credentials and model policies isolated from ordinary tenants.

Attack Vector

An attacker registers or obtains a low-privilege one-api account and generates an API token. The attacker then issues requests to the token-authenticated route with channelid set to an integer of their choosing, incrementing the value to enumerate operator-configured channels. Each successful request causes one-api to forward the call upstream using the targeted channel's stored provider key, bypassing both per-group restrictions and the channel's model allowlist. The Authorization header sent to the upstream provider carries a key the caller was never granted.

Refer to the VulnCheck advisory and GitHub issue #2410 for additional technical context.

Detection Methods for CVE-2026-81027

Indicators of Compromise

Requests to token-authenticated routes containing a channelid path parameter originating from non-administrator accounts.
Sequential or rapidly incrementing channelid values in access logs, consistent with channel enumeration.
Upstream provider usage attributed to accounts or groups that lack an assigned channel in one-api configuration.
Unexpected model invocations against providers that fall outside a user's group allowlist.

Detection Strategies

Correlate one-api access logs with the internal channel-to-user mapping and flag any mismatch between the caller's group and the resolved channel.
Alert on any request where the channelid path parameter is present but the caller is not an administrator.
Baseline per-token upstream request volume and identifier diversity; investigate tokens that touch many distinct channel IDs.

Monitoring Recommendations

Ingest one-api application logs and reverse-proxy logs into a SIEM and retain them for at least 90 days.
Monitor upstream provider dashboards for quota spikes, unusual model usage, and requests from unexpected client identifiers.
Track failed authorization attempts and 4xx responses on channel-pinning endpoints to detect enumeration attempts.

How to Mitigate CVE-2026-81027

Immediate Actions Required

Upgrade one-api to a version later than 0.6.10 that enforces authorization on the channelid path-parameter branch, once available from the maintainers.
Rotate all operator-configured upstream provider API keys stored in one-api channels, since prior exposure cannot be ruled out.
Restrict network access to one-api so only trusted clients can reach token-authenticated routes.
Audit existing tokens and revoke any that show evidence of channel enumeration or unauthorized upstream usage.

Patch Information

Monitor the one-api GitHub repository and issue #2410 for fix availability. Review the vulnerable logic in middleware/auth.go at v0.6.10 to identify the two branches and confirm both perform role checks before a patch is applied.

Workarounds

Place one-api behind a reverse proxy that strips or rejects requests containing the channelid path parameter from non-administrator tokens.
Enforce a WAF rule that blocks the vulnerable route unless the caller matches an administrator allowlist.
Segment operator-managed channels into a separate deployment isolated from tenant-facing traffic until the fix is deployed.

bash

# Example NGINX rule blocking the channelid path parameter
location ~ ^/.*/channel/([0-9]+) {
    if ($http_authorization !~* "Bearer admin-") {
        return 403;
    }
    proxy_pass http://one_api_upstream;
}