---
id: "CVE-2026-111671"
kind: "vulnerability"
aliases: ["CVE-2026-111671"]
title: "Cube-studio: authenticated users can stop or redeploy other users' notebooks"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "cube-studio", "kubernetes", "machine-learning", "self-hosted"]
not_affected_if: ["no-untrusted-accounts", "single-user-deployment"]
published_at: "2026-10-16T18:17:49+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:36:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111671", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Cube-studio: authenticated users can stop or redeploy other users' notebooks

Cube-studio, a Kubernetes-based machine learning platform, does not check ownership of notebook and inference service ids on its lifecycle endpoints. Any logged-in user can pass sequential ids to stop, reset, clear or redeploy other users' notebooks and services, taking production inference endpoints offline.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment runs Cube-studio at a version through `2026.09.01`
- Review `view_notebook.py`, `view_inferenceserving.py` and `view_serving.py` for ownership checks on lifecycle endpoints (unknown if the sources give a fixed version)

## Fix

- unknown: the sources do not name a fixed version; check the Cube-studio project for a release after `2026.09.01`
- Until patched, restrict who holds accounts on the platform and limit network access to its web interface

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111671

## From the sources

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_