Live › vulnerability › CVE-2026-111672
Go to dashboardCube-studio's pipeline views do not check project group ownership, so any logged-in user can open pipelines by id that belong to other groups. An attacker can enumerate sequential ids to read DAGs, cluster names, namespaces, Argo workflow ids and pod names, or clone other teams' pipelines.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Cube-studio where several project groups or tenants share one instance and any user can log in. Single-team instances where every account belongs to the same trusted group face little added exposure from this flaw. Sources do not say which configurations are most exposed.
No product ranges from the sources yet.
2026.09.012026.09.01 once a fixed release is published (fixed version: unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-111672")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.