Analyze ADCS ESC14 Scenario A Attack Paths
BloodHound now models ADCS ESC14 Scenario A attack paths, helping you identify explicit certificate-mapping abuse paths that rely onaltSecurityIdentities.In ESC14 Scenario A, an attacker who can modify a target principal’s altSecurityIdentities attribute, or who has equivalent control through the Public-Information property set, can add an explicit certificate mapping that points to a certificate they control and authenticate as the target.This release adds graph coverage for the following edges:This requires upgrading to SharpHound v2.14.0 to collect the new edges.
OpenGraph Entity Info
As an OpenGraph extension author, define rich, markdown-based context for node and relationship kinds so BloodHound users can see curated Entity Panel content instead of raw properties.OpenGraph extensions can now define custom entity panel content for node and relationship kinds, including:- Accordion sections
- Section titles
- Markdown content
- Display order
include-info=true, allowing the UI and integrations to render curated context instead of relying only on raw property lists. This release establishes the framework for custom entity panel accordion content and supports deep links to sections within OpenGraph-defined entity panels.Related API reference:OpenGraph Data Quality Statistics
Validate uploaded OpenGraph data without writing custom Cypher queries by reviewing node-count statistics on the Data Quality page.BloodHound now expands data quality statistics beyond the existing Active Directory and Azure/Entra ID views to include OpenGraph environments. You can review object-type breakdowns for data from SpecterOps-supported extensions (such as GitHub, Jamf, and Okta), as well as community and custom extensions.BloodHound also stores OpenGraph data quality statistics after analysis, exposes environment and aggregate statistics through API endpoints, and returns OpenGraph environment kind metadata from the environment selector API so Data Quality workflows can distinguish environments more clearly.This feature is available under early access. Enable on the Administration > Early Access Features page to access it.
Case-Sensitive OpenGraph Object IDs
Preserve distinct OpenGraph objects whoseobjectid values differ only by case while keeping Active Directory and Microsoft Entra ID ingest behavior case-insensitive.This is a SpecterOps-managed feature. If it is not enabled in your environment, contact your account team for assistance.
Accessibility and Contrast Improvements
Navigate BloodHound with improved contrast, clearer focus states, and visual indicators that do not rely on color alone.This release improves color and non-text contrast across key UI surfaces, updates the Data Quality chart palette, and makes Attack Path timeline graphs easier to interpret.Separate OpenHound Configuration and Secrets
Store the BloodHound Enterprise destination URL as configuration instead of a secret when you set up scheduled OpenHound collectors.OpenHound now reads destination.bloodhoundenterprise.url through DLT configuration, so you can define the tenant URL in config.toml, an environment variable, or Helm values while keeping token_id and token_key in the secrets.toml file.The sample Docker Compose, Helm, and collector configuration files now follow this split and remove the stale Helm interval example.This is a non-breaking change. Existing collector secrets files that still define
destination.bloodhoundenterprise.url continue to work because DLT configuration lookup can read the value from the secrets.toml file.Upload-Only Role Access Enforcement
Prevent users with the Upload-only role from accessing analysis pages that are outside their role permissions.BloodHound Enterprise now blocks upload-only users from the Posture and Attack Paths pages.Auditor SSO Configuration Access
Allow users with the Auditor role to review SSO provider configuration without granting provider management permissions.Auditors can now view the SSO Configuration page in a read-only state while create and management actions remain restricted to users with the Admin role.Attack Path Findings API Availability
BloodHound Enterprise now exposes the GET /api/v2/attack-paths/findings endpoint so API clients can retrieve a unified, paginated list of Attack Path findings.Privilege Zone Review Improvements
Review Privilege Zone certifications and rules with clearer table behavior, more usable layouts, and better validation feedback.BloodHound now lets you fully close the certification entity panel area, improves certification table sizing and result-count terminology, makes kind-count summaries easier to read, and shows a clear error when an object ID-based rule contains an invalid object ID.Fixed Issues
API and Access Control
- Added missing authorization checks to the
/api/v2/custom-nodesAPI endpoint. - Added Environment Targeted Access Control checks to the OpenGraph node and relationship lookup APIs so restricted users cannot access graph entity data outside their allowed environments.
- Resolved an issue where parameter input fields in the API Explorer could render too small or hide typed values.
Explore
- Resolved an issue where selecting a node with an
idproperty from the table layout on the Explore page failed to load object information in the entity panel. - Removed extra whitespace from graph node labels so selected nodes are centered more consistently.
Development
Resolved an issue where UI source code changes in Docker Compose development stacks were not reflected in the browser without restarting containers.Zone Builder
- Resolved an issue on the Certifications page where select input borders could appear clipped in the Additional Filters modal.
- Fixed an issue where the Summary view displayed object counts for a previously selected environment because the object count request retained the
environmentIdparameter from the Details view.
Fixed Issues
Resolved an issue where running
scheduler.py from the command line could produce a logging error on Windows operating systems.