Auth bypass in Specterops Bloodhound
CVE-2026-59255
BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints.
Vulnerability class: Broken Access Control
EPSS: 0.004 (36.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L.
Affected products
- Specterops Bloodhound — versions 0, 8f790351349fd87bcb04377aba84cba6495825b3
Weakness classification (CWE)
References
- Researcher Disclosure (technical-description, exploit)
- Pull Request (issue-tracking)
- Patch Commit (patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-59255?
- CVE-2026-59255 is a high-severity vulnerability in Specterops Bloodhound, classified under Missing Authorization. CVSS score: 7.1/10. Published 2026-07-15.
- How severe is CVE-2026-59255?
- High severity. CVSS v3 base score is 7.1 out of 10.