CVE-2026-59255 SpecterOps CVE debrief

Who should care

Defenders and administrators of BloodHound installations should be aware of this vulnerability and take necessary actions to secure their environments. This includes verifying the integrity of their installations, reviewing configurations, and monitoring for unauthorized changes.

Why it matters

CVE-2026-59255 is a high-severity vulnerability in BloodHound that allows authenticated users to modify the global graph schema. Defenders should verify their installations, review configurations, and monitor for unauthorized changes to prevent potential disruptions.

• An attacker with a valid session token could create, update, or delete custom node types, affecting all users and tenants.
• This could lead to unauthorized modifications to the global graph schema, potentially disrupting the functionality of BloodHound.
• Defenders need to verify that their BloodHound instances are updated and monitor for suspicious activity.
• The impact of exploitation could be mitigated by restricting access to the custom-nodes API endpoints.

Technical summary

The vulnerability in BloodHound allows any authenticated user to modify the global graph schema by creating, updating, or deleting custom node types. This is possible due to unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints. The issue affects BloodHound versions up to 9.4.0 and was addressed in commit 8f79035. To mitigate the impact of this vulnerability, defenders should verify the integrity of their BloodHound installations, review configurations, and monitor for unauthorized changes to custom node types. Additionally, restricting access to the custom-nodes API endpoints to only authorized users can help prevent exploitation.

Defensive priority

Defenders should prioritize verifying the integrity of their BloodHound installations, ensuring that all instances are updated to a version that includes the fix for this vulnerability. They should also review their current configurations and monitor for any unauthorized changes to custom node types.

Recommended defensive actions

• Verify that all BloodHound instances are updated to a version that includes the fix for this vulnerability.
• Review current configurations and monitor for any unauthorized changes to custom node types.
• Restrict access to the custom-nodes API endpoints to only authorized users.
• Implement additional monitoring to detect potential exploitation attempts.
• Conduct a thorough review of the BloodHound instance's configurations and custom node types to identify potential security risks.
• Develop a plan to roll back changes if necessary and track exceptions.
• Perform an asset inventory to identify all BloodHound instances in the environment.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. The source references include links to the fix in GitHub and discussions related to the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.