PT-2026-60250 · Specterops+1 · Bloodhound

George Chen · CVE-2026-59255 · Published 2026-07-15 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions BloodHound versions prior to 9.4.1

Description An authorization flaw exists in the custom-nodes API endpoints. Authenticated users with valid session tokens can modify the global graph schema by performing unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints. This allows the creation, update, or deletion of custom node types, which impacts all users and tenants.

Recommendations Update BloodHound to the version containing commit 8f79035. Restrict access to the custom-nodes API endpoints to authorized administrators only.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-59255

Affected Products

Bloodhound

References · 8

• 🔥 https://github.com/SpecterOps/BloodHound/issues/2910 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59255.json · Exploit
• https://github.com/SpecterOps/BloodHound/commit/8f790351349fd87bcb04377aba84cba6495825b3 · Patch
• https://osv.dev/vulnerability/CVE-2026-59255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59255 · Security Note
• https://github.com/SpecterOps/BloodHound/pull/2989 · Note
• https://github.com/SpecterOps/BloodHound · Note
• https://vulncheck.com/advisories/bloodhound-missing-authorization-on-custom-node-management-api · Note