OpenCSG CSGHub through version 2.6.0-ce contains an authorisation bypass vulnerability in its unauthenticated file-resolve route that allows remote attackers to read private repository files, according to a CVE alert published on 2 November 2026. The flaw, CVE-2026-120426, is rated 7.5 out of 10, and it requires no account and no user interaction, which makes internet-facing deployments the main concern.

How the bypass works

Attackers can inject a percent-encoded current_user parameter into the file path, which the portal forwards with its server API key, so the request is treated as authorised even though no genuine user is behind it. That route can then return files from private model, code or space repositories that should only be visible to authorised users. The advisory references the project's own issue tracker and code for the resolve handler, which shows how the parameter reaches the download path.

Why it matters

Private repositories on an AI model hub can hold more than code. They can contain model weights, datasets, configuration files, tokens and other material that an organisation chose not to publish, so a read of private files can expose intellectual property and credentials. The alert rates the impact as high for confidentiality, with no integrity or availability impact claimed for this flaw alone.

What operators should do

Operators should check which CSGHub version they are running, upgrade past the affected range, and restrict internet access to deployments that cannot be upgraded yet. They should also review access logs for unusual file-resolve requests, and rotate any credentials or tokens that were stored in repositories that may have been readable. No exploitation status is confirmed in the alert, so this article does not claim the flaw is being exploited in the wild.

Sources: RedPacket Security, CVE-2026-120426, 2 November 2026; OpenCSG CSGHub issue 1586 via the advisory.