CVE-2026-68905 Hugo Blog: Unauthenticated AI Proxy Allows Abuse of Server-Side API Key

Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints POST /api/blog-assistant, POST /api/blog-search-embedding, POST /api/blog-search-rerank without any authentication check. When deployed following the documented Nginx reverse-proxy setu...