TencentCloud Octop versions up to 1.0.2b6 allow authenticated users with low privileges to read stored provider API keys by sending GET requests to /api/providers and /api/voice/providers. The endpoints only validate the presence of a JWT and fail to check the user's role, exposing plaintext keys that can be used to abuse downstream LLM and voice provider accounts. The weakness, identified as CWE-862, results in loss of confidentiality for the provider credentials and potential service disruption if the keys are misused. This flaw does not grant arbitrary code execution but enables attacker credential compromise that can be leveraged for further attacks.

TencentCloud Octop, from its initial release through version 1.0.2b6. No specific build numbers beyond 1.0.2b6 are impacted, and newer releases may have fixed the issue.

The vulnerability has a CVSS score of 7.1, indicating moderate to high severity. Because the EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog, public exploitation data is limited. Attackers can exploit the flaw by simply authenticating with a valid JWT, which most users possess, and then issuing GET requests to the exposed endpoints. No further prerequisites are required, making the attack straightforward for any authenticated user. The missing role validation provides an easy route to credential disclosure, and since the keys are stored in plaintext, the impact is immediate and significant.