Sub2API is an AI API gateway that allows tenants to issue requests on behalf of the operator's upstream accounts. From versions 0.1.135 through 0.1.168 this gateway’s POST /responses/*subpath handler concatenated client‑supplied subpaths directly into the upstream URL without validation. This omission of sanitisation let an authenticated tenant craft requests that target arbitrary upstream endpoints using the operator’s pooled credentials. The result is that the tenant can move the operator’s credentials to any endpoint controlled by the attacker, enabling unauthorized data access, service disruption or further privilege escalation on downstream services. This vulnerability aligns with CWE‑22 (Path Traversal) and CWE‑441 (Blind Inter‑Service Communication).

Affected deployments are those running Wei‑Shaw Sub2API versions 0.1.135 through 0.1.168. The flaw is fixed in 0.1.169 and later releases, so systems using these versions remain vulnerable.

The CVSS base score of 8.5 indicates a high severity impact under the conditions of authenticated access. EPSS is below 1 %, suggesting that active exploitation may be rare at this time, but the low probability does not diminish the need for remediation. The vulnerability is not yet in CISA’s KEV catalog, yet tenants who can authenticate to the gateway can directly induce the service to issue arbitrary outbound HTTP requests. Because the attacker must be a legitimate tenant, any compromise of tenant credentials or social engineering sufficient to gain tenant login would allow the exploit. The exploitation path is straightforward: authenticated tenant submits a POST payload containing a crafted subpath; the gateway forwards the request to an attacker‑chosen upstream endpoint using the shared credentials. The likely attack vector is an authenticated tenant with the ability to craft a malicious subpath.