New API is a large language mode

Before v0.10.8-alpha.10, QuantumNous new-api mishandles wildcard characters in the authenticated /api/token/search endpoint. The keyword and token inputs are fed into SQL LIKE clauses without properly neutralizing % and _, so a logged-in user can trigger slow, expensive queries and exhaust database or application resources. GitHub flags affected versions as <= v0.10.8-alpha.9, and the fix lands in v0.10.8-alpha.10.

The vendor's MEDIUM call is basically right, and I'd keep it there after a friction audit. The important down-pressure is that exploitation needs a valid account and only buys *availability impact*; there is no confidentiality or integrity loss in the published advisory, no KEV listing, and no public evidence of broad in-the-wild abuse. The up-pressure is that the abuse path is straightforward once authenticated, especially on default SQLite-backed or undersized self-hosted deployments.

Why this verdict

• Start at vendor 6.5 MEDIUM: the CVSS math is reasonable for an easy network-reachable DoS, but it overstates urgency for enterprise triage because PR:L means the attacker is already inside the trust boundary of the application.
• First downward adjustment — attacker position: this requires authenticated remote access, which implies prior compromise, valid tenancy, or legitimate user enrollment. MFA, SSO, private exposure, and account governance all suppress who can even start the chain.
• Second downward adjustment — reachable population: new-api is a popular open-source project, but it is still a specific self-hosted AI gateway, not a universally deployed enterprise platform. That narrows exposure compared with edge appliances, VPNs, or broadly exposed collaboration software.
• Third downward adjustment — impact type: the published record shows availability-only impact. There is no vendor claim of RCE, privilege escalation, data access, or tenant escape, so the blast radius is materially smaller than the CVSS number can make it feel.
• Small upward pressure: the patch adds input validation, pagination, and per-user rate limiting, which suggests the pre-fix abuse path was not theoretical. On undersized or SQLite-backed deployments, one ordinary account may be enough to cause real service pain.

Why not higher?

There is no evidence here of unauthenticated exploitation, code execution, or sensitive-data compromise. The requirement for a valid account compounds with the limited impact class: this is disruptive, but it is still a post-access service exhaustion bug in a specific application component.

Why not lower?

This is not a harmless nuisance. The vulnerable endpoint is remotely reachable once logged in, the exploit mechanics are simple, and the patch itself confirms the vendor had to add multiple guardrails—sanitization, rate limiting, and pagination—to close the hole. If new-api is your central AI gateway, an authenticated user can still knock over something operationally important.

1. Throttle token search aggressively — Apply per-user and per-IP rate limits specifically on /api/token/search to reduce concurrency-based resource exhaustion. For a MEDIUM verdict, deploy this within 30 days if you cannot patch immediately; faster if the service is internet-facing or multi-tenant.
2. Block abusive wildcard patterns — At the reverse proxy or WAF, deny requests where keyword or token contains repeated %, %%, or obviously wildcard-dense patterns. This is a practical stopgap because the upstream fix explicitly sanitizes these cases; deploy within 30 days if patching is delayed.
3. Restrict exposure — Move new-api behind SSO, VPN, corporate IP allowlists, or internal ingress only. Since the exploit requires authentication, shrinking who can authenticate cuts the reachable attacker pool; for a MEDIUM finding, do this during the normal hardening cycle within 30 days if externally exposed.
4. Watch slow queries and endpoint spikes — Alert on elevated latency, CPU, memory, and request volume tied to /api/token/search, plus slow-query logs in SQLite/MySQL/PostgreSQL. This won't prevent exploitation, but it shortens time-to-detect while you move to the patched build.

Run this on the target host or Docker node that actually runs new-api. Invoke it as python3 verify_cve_2026_25591.py --container new-api or python3 verify_cve_2026_25591.py --version v0.10.8-alpha.9; it needs only local file read access unless you use --container, in which case it needs permission to talk to the Docker socket.

#!/usr/bin/env python3
# verify_cve_2026_25591.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / usage error

import argparse
import os
import re
import subprocess
import sys
from typing import Optional, Tuple

FIXED = "v0.10.8-alpha.10"
CANDIDATE_VERSION_FILES = [
    "./VERSION",
    "/app/VERSION",
    "/opt/new-api/VERSION",
    "/usr/local/share/new-api/VERSION",
]

SEMVER_RE = re.compile(r"^v?(\d+)\.(\d+)\.(\d+)(?:-alpha\.(\d+))?$")


def parse_version(v: str) -> Optional[Tuple[int, int, int, int, int]]:
    v = v.strip()
    m = SEMVER_RE.match(v)
    if not m:
        return None
    major, minor, patch, alpha = m.groups()
    # Stable release sorts after alpha releases of same base version.
    is_stable = 1 if alpha is None else 0
    alpha_num = int(alpha) if alpha is not None else 999999
    return (int(major), int(minor), int(patch), is_stable, alpha_num)


def cmp_versions(a: str, b: str) -> Optional[int]:
    pa = parse_version(a)
    pb = parse_version(b)
    if pa is None or pb is None:
        return None
    if pa < pb:
        return -1
    if pa > pb:
        return 1
    return 0


def docker_inspect_version(container: str) -> Optional[str]:
    # Try image tag first.
    try:
        cmd = ["docker", "inspect", "--format", "{{.Config.Image}}", container]
        out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True).strip()
        # Example: calciumion/new-api:v0.10.8-alpha.10
        m = re.search(r":(v?\d+\.\d+\.\d+(?:-alpha\.\d+)?)$", out)
        if m:
            return m.group(1)
    except Exception:
        pass

    # Fallback: read VERSION inside the container.
    for path in ["/app/VERSION", "/VERSION"]:
        try:
            cmd = ["docker", "exec", container, "sh", "-c", f"test -r {path} && cat {path}"]
            out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True).strip()
            if out:
                return out.splitlines()[0].strip()
        except Exception:
            continue
    return None


def local_file_version() -> Optional[str]:
    for path in CANDIDATE_VERSION_FILES:
        if os.path.isfile(path):
            try:
                with open(path, "r", encoding="utf-8") as f:
                    line = f.readline().strip()
                    if line:
                        return line
            except Exception:
                continue
    return None


def judge(version: str) -> Tuple[str, int]:
    comparison = cmp_versions(version, FIXED)
    if comparison is None:
        return (f"UNKNOWN - could not parse version '{version}'", 2)
    if comparison < 0:
        return (f"VULNERABLE - detected version {version} is older than fixed {FIXED}", 1)
    return (f"PATCHED - detected version {version} is at or newer than fixed {FIXED}", 0)


def main() -> int:
    parser = argparse.ArgumentParser(description="Verify exposure to CVE-2026-25591 in QuantumNous new-api")
    parser.add_argument("--version", help="Explicit new-api version, e.g. v0.10.8-alpha.9")
    parser.add_argument("--container", help="Docker container name or ID running new-api")
    args = parser.parse_args()

    detected = None
    source = None

    if args.version:
        detected = args.version.strip()
        source = "argument"
    elif args.container:
        detected = docker_inspect_version(args.container)
        source = f"docker container {args.container}"
    else:
        detected = local_file_version()
        source = "local VERSION file"

    if not detected:
        print("UNKNOWN - unable to determine installed new-api version from provided inputs or common local files")
        return 2

    result, rc = judge(detected)
    print(f"{result} (source: {source})")
    return rc


if __name__ == "__main__":
    sys.exit(main())

Sources

1. NVD CVE-2026-25591
2. GitHub Security Advisory GHSA-w6x6-9fp7-fqm4
3. Upstream patch commit 3e1be18
4. Upstream fixed release v0.10.8-alpha.10
5. Project README / deployment guidance
6. FIRST EPSS API documentation
7. CISA Known Exploited Vulnerabilities Catalog
8. Go vulnerability entry GO-2026-4531