CVE-2026-123788

A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended.

• CWE-840
• CWE-841

• https://github.com/chenyme/grok2api/
• https://github.com/chenyme/grok2api/commit/7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4
• https://github.com/chenyme/grok2api/issues/1072
• https://github.com/chenyme/grok2api/pull/1073
• https://github.com/chenyme/grok2api/releases/tag/v3.1.7
• https://vuldb.com/cve/CVE-2026-123788
• https://vuldb.com/submit/1033606
• https://vuldb.com/vuln/431934
• https://vuldb.com/vuln/431934/cti

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123782ChatWiki before 2.10.0 contains an insecure direct object re…4.3
• CVE-2026-123783Skyvern through 1.0.56 contains a sandbox bypass vulnerabili…8.8
• CVE-2026-123784Fluxbox through 1.3.7 contains an OS command injection vulne…7.8
• CVE-2026-123785Fluxbox through 1.3.7 contains an infinite loop vulnerabilit…5.5
• CVE-2026-123786Agenta before 0.122.5 contains a server-side request forgery…8.5
• CVE-2026-123787A weakness has been identified in nexmoe VidBee up to 1.3.13…4.3
• CVE-2026-12379An Open Redirect vulnerability (CWE-601) exists in the OAuth…6.8
• CVE-2026-123791A vulnerability was detected in OpenBMB Internet of Agents u…7.3
• CVE-2026-123792The Symfony Yaml components Inline and Parser, parse some YA…8.7
• CVE-2026-1238The SlimStat Analytics plugin for WordPress is vulnerable to…7.2
• CVE-2026-12380Improper neutralization of input during web page generation …6.1
• CVE-2026-12382A flaw was found in the AAP Gateway Envoy proxy configuratio…8.2