Vulnerabilidades de SpecterOps
CVEs publicadas que afetam produtos de SpecterOps: 2 registro(s), com severidade, exploração e correções.
CVE-2026-85241
Média · 6.3
CWE-266 03/09/2026
SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization
A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. Upgrading to version 9.6.0-rc1, 9.6.0 and 9.7.0-rc3 is sufficient to fix this issue. This patch is called 39d1276a63e95a7713f954dea632a19651d9cebb. You should upgrade the affected component.
CVE-2026-59255
Alta · 7.1
CWE-862 15/07/2026
BloodHound Missing Authorization on Custom Node Management API
BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints.