specterops vulnerabilities

Products

• specterops/bloodhound 2

Latest specterops CVEs

Newest publication first

1. CVE-2026-85241 SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization

   Published 2026-09-03

   Medium·CVSS 5.3 EPSS 0.37%

   A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to...

2. CVE-2026-59255 BloodHound Missing Authorization on Custom Node Management API

   Published 2026-07-15

   High·CVSS 7.1 EPSS 0.44%

   BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.