GO · AUGUST 2026 · EARLY WARNING

new-api Go Package Leaks Root Access Token: Early Warning

Q: Am I affected?

You are affected if you are using the new-api Go package in versions before v1.0.0-rc.7 for the access token leak issue. For the integer overflow issue, you are affected if you are using versions up to and including v1.0.0-rc.17.

Q: What should I do right now?

Upgrade the new-api Go package to version v1.0.0-rc.7 or later to mitigate the risk of privilege escalation. Monitor the primary sources for updates on the integer overflow issue.

Q: Is this vulnerability being exploited in the wild?

There is no confirmed report of this vulnerability being exploited in the wild at this time.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: new-api (go)
Affected versions: < 1.0.0-rc.7
Patched version: v1.0.0-rc.7

GHSA-6X2C-PHFF-WX57

An early warning has been issued for the new-api Go package, which reportedly leaks the root user's access token. This vulnerability allows admin users to authenticate as root and access root-only endpoints. Versions before v1.0.0-rc.7 are affected.

What happened

The new-api Go package, versions before v1.0.0-rc.7, is under investigation for leaking the root user's access token. This vulnerability, tracked as GHSA-6X2C-PHFF-WX57 and CVE-2026-64859, allows admin users to authenticate as root and access root-only endpoints. The issue was first flagged on August 17, 2026. Additionally, another critical vulnerability, GHSA-8r8v-xf7q-rcpr (CVE-2026-71479), involves an integer overflow in quota billing that yields negative charges. This issue affects versions up to and including v1.0.0-rc.17.

To assess your exposure, check if your systems use the new-api Go package and determine the version in use. If you are using a version before v1.0.0-rc.7, you are potentially vulnerable to the access token leak. For the integer overflow issue, versions up to and including v1.0.0-rc.17 are affected.

What to do about it

Upgrade the new-api Go package to version v1.0.0-rc.7 or later to mitigate the risk of privilege escalation due to the access token leak.
For the integer overflow issue, upgrade to a version beyond v1.0.0-rc.17 once a patched version is available.
Monitor the primary sources for updates on patched versions and further details.
Review your system's access controls and ensure that only necessary users have admin privileges.
Consider implementing additional monitoring for unusual access patterns that may indicate a compromise.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If new-api is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using the new-api Go package in versions before v1.0.0-rc.7 for the access token leak issue. For the integer overflow issue, you are affected if you are using versions up to and including v1.0.0-rc.17.

What should I do right now?

Upgrade the new-api Go package to version v1.0.0-rc.7 or later to mitigate the risk of privilege escalation. Monitor the primary sources for updates on the integer overflow issue.

Is this vulnerability being exploited in the wild?

There is no confirmed report of this vulnerability being exploited in the wild at this time.

Sources

Join the 0Day waitlist →

← Back to all threats