{"id":"CVE-2026-111671","kind":"vulnerability","aliases":["CVE-2026-111671"],"related":[],"title":"Cube-studio: authenticated users can stop or redeploy other users' notebooks","description":"Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.","summary":"Cube-studio, a Kubernetes-based machine learning platform, does not check ownership of notebook and inference service ids on its lifecycle endpoints. Any logged-in user can pass sequential ids to stop, reset, clear or redeploy other users' notebooks and services, taking production inference endpoints offline.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","cube-studio","kubernetes","machine-learning","self-hosted"],"not_affected_if":["no-untrusted-accounts","single-user-deployment"],"how_to_check":"- Check whether the deployment runs Cube-studio at a version through `2026.09.01`\n- Review `view_notebook.py`, `view_inferenceserving.py` and `view_serving.py` for ownership checks on lifecycle endpoints (unknown if the sources give a fixed version)","fix":"- unknown: the sources do not name a fixed version; check the Cube-studio project for a release after `2026.09.01`\n- Until patched, restrict who holds accounts on the platform and limit network access to its web interface","status":"open","published_at":"2026-10-16T18:17:49+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:34+00:00","updated_at":"2026-10-25T03:36:34+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:36:34Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version; check the Cube-studio project for a release after `2026.09.01`\n- Until patched, restrict who holds accounts on the platform and limit network access to its web interface","reach":"network","title":"Cube-studio: authenticated users can stop or redeploy other users' notebooks","impact":"medium","summary":"Cube-studio, a Kubernetes-based machine learning platform, does not check ownership of notebook and inference service ids on its lifecycle endpoints. Any logged-in user can pass sequential ids to stop, reset, clear or redeploy other users' notebooks and services, taking production inference endpoints offline.","category":"ai-tooling","nicknames":[],"who_cares":["cube-studio","kubernetes","machine-learning","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"other users' pods deleted and production inference endpoints taken offline","analyst_note":"Find the fixed Cube-studio version and confirm whether the flaw is reachable by default; the NVD entry alone gives no patch or check.","how_to_check":"- Check whether the deployment runs Cube-studio at a version through `2026.09.01`\n- Review `view_notebook.py`, `view_inferenceserving.py` and `view_serving.py` for ownership checks on lifecycle endpoints (unknown if the sources give a fixed version)","needs_analyst":true,"not_affected_if":["single-user-deployment","no-untrusted-accounts"],"who_is_affected":"Teams running Cube-studio with multiple authenticated users who share the platform, since the flaw lets one user act on another's notebooks and serving endpoints. Single-user deployments where every account belongs to the same trusted person are less exposed. unknown whether the sources say more about default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":3348,"output_tokens":657,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111671':15A,18A '-2026':14A,17A '2026.09.01':85C 'ai':20B 'ai-tool':19B 'allow':94C 'attack':110C 'authent':4A,95C 'base':38B 'check':44B 'clear':68B,100C 'contain':86C 'cube':2A,23B,33B,82C 'cube-studio':1A,22B,32B,81C 'cve':13A,16A 'delet':124C 'direct':89C 'endpoint':55B,79B,117C,130C 'host':31B 'id':51B,64B,109C,114C 'infer':49B,78B,129C 'insecur':88C 'kubernet':25B,37B 'kubernetes-bas':36B 'learn':28B,40B 'lifecycl':54B,116C 'log':58B 'logged-in':57B 'machin':27B,39B 'machine-learn':26B 'notebook':12A,47B,73B,105C 'object':90C 'offlin':80B,131C 'ownership':45B 'pass':62B,112C 'platform':41B 'pod':125C 'product':77B,128C 'redeploy':9A,70B,102C 'refer':91C 'reset':67B,99C 'self':30B 'self-host':29B 'sequenti':63B,113C 'servic':50B,75B,107C 'stop':7A,66B,98C 'studio':3A,24B,34B,83C 'take':76B,127C 'tool':21B 'user':5A,11A,60B,72B,96C,104C 'view_inferenceserving.py':120C 'view_notebook.py':119C 'view_serving.py':122C 'vulner':92C","nicknames":[],"mitigations":[],"who_affected":"Teams running Cube-studio with multiple authenticated users who share the platform, since the flaw lets one user act on another's notebooks and serving endpoints. Single-user deployments where every account belongs to the same trusted person are less exposed. unknown whether the sources say more about default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111671","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111671","severity":null,"published_at":"2026-10-16T18:17:49+00:00","modified_at":"2026-10-16T22:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}