---
id: CVE-2026-8757
title: A vulnerability was found in adenhq hive up to 0.11.0
summary: >-
  A vulnerability was found in adenhq hive up to 0.11.0. This affects the
  function _read_events_tail of the file
  core/framework/server/routes_sessions.py of the component Delete Request
  Handler. Performing a manipulation results in path tr…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-22
vendor: adenhq
product: hive
affected:
  - hive <= 0.11.0
published: '2026-05-17'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8757'
references:
  - url: 'https://gist.github.com/YLChen-007/ff3ff201b05d13d41f949f86e9187bd2'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/811276'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/364384'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/364384/cti'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.00978
epssPercentile: 0.61376
ingestedAt: '2026-10-14T20:53:12.292Z'
---

## Overview

A vulnerability was found in adenhq hive up to 0.11.0. This affects the function _read_events_tail of the file core/framework/server/routes_sessions.py of the component Delete Request Handler. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `hive <= 0.11.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.