CVE-2026-9306: QuantumNous new-api Auth Bypass Flaw

CVE-2026-9306 Overview

CVE-2026-9306 is an authorization bypass vulnerability in QuantumNous new-api versions up to 0.12.1. The flaw resides in the RelayMidjourneyImage/GetByOnlyMJId function within router/relay-router.go, part of the Midjourney Image Relay Endpoint component. Remote attackers can bypass authorization checks without prior authentication or user interaction. Public disclosure of the exploit has occurred, though successful exploitation requires high attack complexity. The vendor was contacted prior to disclosure but did not respond. The weakness is categorized under CWE-285: Improper Authorization.

Critical Impact
Remote attackers can bypass authorization controls in the Midjourney Image Relay Endpoint, potentially accessing image resources intended to be protected.

Affected Products

QuantumNous new-api versions up to and including 0.12.1
Component: Midjourney Image Relay Endpoint (router/relay-router.go)
Affected functions: RelayMidjourneyImage and GetByOnlyMJId

Discovery Timeline

2026-05-23 - CVE-2026-9306 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9306

Vulnerability Analysis

The vulnerability stems from improper authorization checks in the Midjourney Image Relay Endpoint of QuantumNous new-api. The affected handlers RelayMidjourneyImage and GetByOnlyMJId in router/relay-router.go permit access to image relay resources without correctly verifying caller permissions. An unauthenticated remote attacker can construct requests that bypass intended access controls.

Exploitation is reported as difficult and requires a high level of complexity, which limits opportunistic attacks. Confidentiality impact is limited to information accessible through the relay endpoint, while integrity and availability are unaffected. The exploit has been publicly disclosed and may be used in targeted scenarios.

Root Cause

The root cause is an improper authorization implementation [CWE-285] in the relay routing logic. The endpoint identifies resources by a Midjourney-only identifier (MJId) without enforcing that the requesting principal owns or has rights to the underlying object. Identifier-based lookup without ownership validation enables direct object access by any network-reachable client.

Attack Vector

Attackers reach the endpoint over the network without authentication or user interaction. The adversary issues crafted HTTP requests to the Midjourney image relay route, supplying an MJId value that resolves to a resource belonging to another principal. Because the handler does not bind the lookup to an authenticated session or permission scope, the server returns the resource. No memory corruption or code execution is involved — the bypass is purely a logic flaw in the authorization layer. Refer to the published GitHub Gist resource and VulDB entry #365253 for technical proof-of-concept details.

Detection Methods for CVE-2026-9306

Indicators of Compromise

Unauthenticated HTTP requests to Midjourney relay routes referencing MJId parameters from unexpected source IP ranges.
Successful HTTP 200 responses on relay endpoints without preceding authentication or session-establishment requests.
Sequential or enumeration-style access patterns iterating over Midjourney identifiers in access logs.

Detection Strategies

Audit web access logs for requests to /relay/... Midjourney image paths that lack valid session tokens or API keys.
Correlate request volume per source IP against the relay endpoint to identify enumeration of MJId values.
Compare requesting user context against the resource owner recorded for each retrieved MJId to surface authorization mismatches.

Monitoring Recommendations

Enable verbose logging on router/relay-router.go handlers, capturing requester identity, target MJId, and response status.
Forward application logs to a centralized analytics platform and alert on anonymous successful responses from relay endpoints.
Apply rate limiting and anomaly detection to the Midjourney relay path to surface scraping or enumeration behavior.

How to Mitigate CVE-2026-9306

Immediate Actions Required

Restrict network exposure of QuantumNous new-api instances running version 0.12.1 or earlier behind authenticated reverse proxies or VPN access only.
Disable the Midjourney image relay feature if not in active use until a vendor patch is available.
Review historical access logs for unauthorized retrieval of Midjourney image resources via GetByOnlyMJId.

Patch Information

No vendor patch is available at the time of disclosure. The QuantumNous project was contacted prior to publication but did not respond. Monitor the QuantumNous new-api repository for updates beyond version 0.12.1 that introduce authorization enforcement on relay handlers. Review the VulDB submission #812196 and VulDB CTI for #365253 for any vendor remediation updates.

Workarounds

Place the application behind an authenticating gateway that validates session or API key presence before forwarding requests to relay routes.
Add a web application firewall rule that blocks requests to Midjourney relay endpoints lacking authentication headers.
Implement an application-level middleware that maps each MJId to its owning principal and rejects requests where the requester does not match.

bash

# Example nginx rule to require an Authorization header on relay endpoints
location ~ ^/mj/image/ {
    if ($http_authorization = "") {
        return 401;
    }
    proxy_pass http://new_api_backend;
}