Database/AI/ML frameworks & serving
nexent: unauthenticated storage API deletes arbitrary objects from the backing MinIO store
Impact
The file management endpoint DELETE /storage/{object_name:path} has no authentication and no validation of the caller-controlled object path, so an unauthenticated request deletes any object in the underlying MinIO store that nexent's credentials can reach - not only objects nexent itself created. On a shared object store that is other workloads' data as well as nexent's. The practical outcome for an operator is data loss with no recovery short of backups, and the serving tier offline while the corpus is rebuilt. This is the storage-API sibling of CVE-2026-31215, which reaches the same store through the ElasticSearch interface.
Who can reach it
Anyone who can reach the nexent backend API over the network. No authentication is required.
What to do
No fixed version is named for nexent 1.7.5.2; the record cites only the project repository. Restrict network reach to the backend, put authentication in front of the storage API, and scope the MinIO credentials nexent holds down to its own bucket and prefix so a successful call cannot reach anyone else's objects. Verify backups before relying on this being unexploited.
References
Related entries
- LiteLLM (JWT auth): Auth bypass when `enable_jwt_auth` is setCVE-2026-35030 · LiteLLM (JWT auth)Critical
- vLLM: ASGI request handling lets callers bypass API-key authentication on the OpenAI endpointsCVE-2026-48746 · vLLM OpenAI-compatible API server (AuthenticationMiddleware)Critical
- SGLang (multimodal runtime): Unauthenticated path traversalCVE-2026-7302 · SGLang (multimodal runtime)Critical
- Ollama (GGUF model loader): Heap out-of-bounds read from an attacker-supplied GGUF via `/api/create`CVE-2026-7482 · Ollama (GGUF model loader)Critical
- Cocos AI: TDX aTLS verifier ignores expected REPORT_DATA, accepting replayed attestation evidenceCVE-2026-92701 · Cocos AI (Intel TDX aTLS attestation verifier, VerifTeeAttestation)Critical
- Cocos AI: SEV-SNP verifier skips ReportData binding when caller passes empty expected valueCVE-2026-92702 · Cocos AI (AMD SEV-SNP attestation verifier, VerifyAttestationReportTLS)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.