CVE-2026-123748

A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component.

• CWE-400
• CWE-404

• https://github.com/chenyme/grok2api/
• https://github.com/chenyme/grok2api/commit/7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4
• https://github.com/chenyme/grok2api/issues/1071
• https://github.com/chenyme/grok2api/pull/1073
• https://github.com/chenyme/grok2api/releases/tag/v3.1.7
• https://vuldb.com/cve/CVE-2026-123748
• https://vuldb.com/submit/1033605
• https://vuldb.com/vuln/431905
• https://vuldb.com/vuln/431905/cti

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123677A vulnerability was found in xxyopen/201206030 novel up to 3…4.3
• CVE-2026-1237Vulnerable cross-model authorization in juju. If a charm's c…2.1
• CVE-2026-12370ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Netwo…7.6
• CVE-2026-12372A Server-Side Request Forgery (SSRF) vulnerability exists in…3.7
• CVE-2026-12374Improper certificate validation and a time-of-check time-of-…6.4
• CVE-2026-123746The Symfony Security HTTP component AuthenticatorManager::au…2.3
• CVE-2026-12375The uncanny-automator-pro WordPress plugin before 7.3.0.6 wa…9.8
• CVE-2026-12376The Academy LMS WordPress plugin through 3.8.2 does not rest…4.3
• CVE-2026-12378The Appointment Booking Calendar Plugin and Scheduling Plugi…8.1
• CVE-2026-123782ChatWiki before 2.10.0 contains an insecure direct object re…4.3
• CVE-2026-123783Skyvern through 1.0.56 contains a sandbox bypass vulnerabili…8.8
• CVE-2026-123784Fluxbox through 1.3.7 contains an OS command injection vulne…7.8