CVE-2026-29023 describes a vulnerability in KeygraphHQ Shannon where a hard-coded API key is embedded in the router configuration. If the router component is enabled and accessible over the network, attackers can authenticate using this known static key. This enables them to proxy requests through the Shannon instance, leveraging the victim’s upstream provider API credentials without authorization. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials). Although the affected version is 0, a mitigation commit (023cc95) has been introduced to reduce exploitability.

An attacker who can reach the router port can authenticate with the hard-coded key, allowing unauthorized proxying of API requests. This can result in unauthorized API usage and potential exposure of sensitive data contained in proxied requests and responses. The CVSS 4.0 score of 6.9 (medium severity) reflects network attack vector, low complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

A fix has been introduced in commit 023cc95 that mitigates the general exploitability of this vulnerability. Users should update to a version that includes this commit or apply the patch if available. Since no official patch link is provided, users must consult KeygraphHQ for the updated version or patch. Until then, disabling or restricting access to the router component can reduce exposure.