CVE-2026-90603: Open-Generative-AI RCE Vulnerability

CVE-2026-90603 Overview

CVE-2026-90603 is an unrestricted file upload vulnerability in Anil-matcha Open-Generative-AI versions up to 1.0.11 and 2.0.0. The flaw resides in the /api/upload-binary endpoint of the S3 Upload component. An attacker can manipulate the x-proxy-target-url argument to upload arbitrary files through the proxy without authentication. The attack can be launched remotely across the network without user interaction. The vendor addressed the issue with commit f013270957f75e439eaf97eb2a93decb32a4543e. This weakness is classified under CWE-284: Improper Access Control.

Critical Impact
Remote, unauthenticated attackers can abuse the S3 upload proxy to place arbitrary files and leak presigned credentials, enabling downstream abuse of cloud storage.

Affected Products

Anil-matcha Open-Generative-AI version 1.0.11
Anil-matcha Open-Generative-AI version 2.0.0
/api/upload-binary route (S3 Upload component)

Discovery Timeline

2026-09-13 - CVE-2026-90603 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90603

Vulnerability Analysis

Open-Generative-AI exposes a Next.js API route at /api/upload-binary that proxies file uploads to an S3-compatible backend. The route accepts a caller-controlled x-proxy-target-url header (or form field) that determines where uploaded binary content is forwarded. Before the patch, the handler processed the request and forwarded credentials without verifying that the caller possessed a valid API key. Any remote client could invoke the endpoint and push arbitrary content through the proxy. The unrestricted upload behavior also created a channel for leaking presigned S3 credentials tracked in issue #310.

Root Cause

The upload handler in app/api/upload-binary/route.js performed no authentication check before parsing the multipart form and executing the proxy request. The related helper module app/api/app/[[...path]]/route.js accepted API keys only through cookie-based paths that could be manipulated, and forwarded browser cookies and authorization headers to downstream services. Missing authorization enforcement on a sensitive proxy route matches CWE-284 (Improper Access Control).

Attack Vector

An unauthenticated attacker sends an HTTP POST to /api/upload-binary with a crafted x-proxy-target-url value and a multipart body containing arbitrary content. The server forwards the payload to the attacker-influenced target using the application's proxy context. There are no privileges, user interaction, or local access required.

javascript

// Patch: app/api/upload-binary/route.js
import { NextResponse } from 'next/server';
-import { validateUploadProxyTarget } from '../../../src/lib/uploadProxyTarget';
+import { validateUploadProxyTarget, getApiKeyFromRequest, isBlockedFileType } from '../../../src/lib/uploadProxyTarget';

 export async function POST(request) {
     try {
+        const apiKey = getApiKeyFromRequest(request);
+        if (!apiKey) {
+            return NextResponse.json({ error: 'Unauthorized: Missing API key' }, { status: 401 });
+        }
+
         const formData = await request.formData();

         // Extract the original S3 target URL we injected earlier
// Source: https://github.com/Anil-matcha/Open-Generative-AI/commit/f013270957f75e439eaf97eb2a93decb32a4543e

The patch introduces an explicit API-key check and blocked file-type validation before any upload processing occurs.

Detection Methods for CVE-2026-90603

Indicators of Compromise

Unauthenticated POST requests to /api/upload-binary with an x-proxy-target-url header referencing external or unexpected S3 endpoints.
HTTP 200 responses from the upload proxy for clients that never presented a valid Authorization or x-api-key header.
Outbound connections from the application host to S3 buckets or presigned URLs not associated with the tenant's configured storage.

Detection Strategies

Inspect web server and reverse proxy logs for requests to /api/upload-binary where authentication headers are absent or malformed.
Alert on requests where the x-proxy-target-url value points to a domain outside an allowlist of approved storage endpoints.
Correlate upload attempts with subsequent egress traffic to identify credential leakage or unexpected file placement in S3.

Monitoring Recommendations

Enable verbose request logging on Next.js API routes and forward events to a centralized SIEM for retention and search.
Monitor S3 bucket access logs for PUT operations that lack a matching authenticated session in the application layer.
Track error rates and 401 responses on /api/upload-binary after patching to confirm the new authentication check is enforced.

How to Mitigate CVE-2026-90603

Immediate Actions Required

Deploy commit f013270957f75e439eaf97eb2a93decb32a4543e from the Open-Generative-AI repository to all affected instances.
Rotate any S3 access keys, presigned URL signing secrets, and API keys that may have been exposed through the vulnerable proxy.
Audit S3 buckets for unauthorized objects uploaded through /api/upload-binary since deployment.

Patch Information

The maintainer resolved CVE-2026-90603 in commit f013270957f75e439eaf97eb2a93decb32a4543e. The fix adds an authentication requirement via getApiKeyFromRequest, blocks disallowed file types with isBlockedFileType, and stops forwarding browser cookie and authorization headers to the upstream MuAPI service. Additional context is available in the VulDB advisory.

Workarounds

Restrict network access to /api/upload-binary at the reverse proxy or WAF layer until the patch is applied.
Enforce an allowlist for the x-proxy-target-url value so only approved S3 endpoints can be reached.
Require an Authorization: Bearer or x-api-key header at the edge and reject unauthenticated upload requests before they reach the application.

bash

# Nginx example: block unauthenticated upload requests at the edge
location = /api/upload-binary {
    if ($http_authorization = "") { return 401; }
    if ($http_x_api_key = "")     { return 401; }
    proxy_pass http://open_generative_ai_upstream;
}