THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-64865 — New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and upda

[NVD] CVE-2026-64865 — New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and upda

lownvdPublished 2026-08-17

CVE-2026-64865 CVSS: None Published: 2026-08-17T16:17:22.427

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Q

MITRE ATT&CK techniques

Artificial IntelligenceT1588.007

Indicators of compromise

CVE-2026-64865cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-64865