Bentley ID: BE-2026-0005
CVE IDs: CVE-2026-101898, CVE-2026-101899, CVE-2026-101900, CVE-2026-101901, CVE-2026-101902, CVE-2026-101903, CVE-2026-101904, CVE-2026-101905, CVE-2026-101906, CVE-2026-101907, CVE-2026-101908, CVE-2026-101909
Severity: 7.0 (CVSS v4.0)
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Published: October 9, 2026

Summary
Assetwise Inspections server application includes a potentially vulnerable dependency that in certain circumstances could allow an attacker to redirect to untrusted sites, 'Open Redirect', or potentially initiate a 'Confused Deputy' via unintended proxy.

Details
AssetWise Inspections use Axios' toolset as part of the solution. In some circumstances this toolkit could potentially allow an attacker, who successfully exploits this vulnerability, to redirect to untrusted sites containing malware. The vulnerability may also be able to bypass access controls or hide the source of malicious requests using AssetWise Inspections as a proxy.

Affected and Mitigated Versions

Mitigations
Bentley strongly recommends an upgrade to latest versions of AssetWise Inspections Server(web). Please contact Bentley Support for assistance.

Acknowledgments
We would like to thank and acknowledge Axios for the responsible disclosure.

Revision History