CVE-2026-111672

MediumCVSS 4.3

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Summary

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.

Risk Assessment

Exposure of internal infrastructure details (clusters, namespaces, Argo workflows, pods) can facilitate further attacks. The ability to clone other project groups' pipelines breaks project isolation and may lead to data leakage.

Recommendation

Upgrade Cube-studio beyond version 2026.09.01 once a fixed release is available. Until then, enforce project group membership checks on all pipeline endpoints.

Other vulnerabilities in Cube-studio

CVE-2026-111671High
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS