CVE-2026-8757 is a high severity (CVSS 7.3) path traversal in adenhq Hive up to version 0.11.0. The session history deletion endpoint does not sanitize a path value, so a remote request can reach beyond the intended folder. The record says the vendor did not respond, so no fix is confirmed.
What's affected
The record lists adenhq Hive up to 0.11.0, and names the function _read_events_tail in core/framework/server/routes_sessions.py, in the delete request handler. The public write-up describes the session history deletion endpoint of the Hive server, and says the request needs no authentication.
I could not confirm a fixed release. The record says the vendor was contacted early and did not respond. Check the project repository for a release after 0.11.0.
How to check if you're exposed
Find where Hive runs and which version it is. For a Python install, ask pip:
pip list | grep -i hive
Then check who can reach its HTTP server. The write-up describes an API that deletes session data from disk, so any listener bound to a shared network or the internet is in scope. Also check which operating system account runs it, since the damage a traversal can do is limited by that account's file permissions.
What to do now
- Bind the Hive server to localhost, or place it behind a firewall that blocks untrusted networks.
- Run it under a dedicated low privilege account that can only write to its own data folder.
- Keep backups of the data directory the service uses.
- Watch the project repository for a release after 0.11.0 that fixes the handler, and update when it appears.
- Add a reverse proxy rule that rejects encoded path separators in request paths, if you must expose the service.
Why it matters
The weakness is CWE-22 (path traversal). The public write-up says other endpoints pass the session identifier through a safe-path helper, and this one did not. A value that was meant to name a single folder could include parent directory steps, and the code then removed whatever the resulting path pointed to.
Missing a helper on one route out of many is a common pattern. Shared validation applied at the framework layer, rather than inside each handler, avoids it.
The record says an exploit is public. It does not say the flaw is exploited in the wild, and it is not in the CISA KEV list.
Quick check
Is a fixed version available?
I could not confirm one. Treat the service as vulnerable and reduce exposure until the project ships a fix.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
