Live › vulnerability › CVE-2026-111701
Go to dashboardOtterMind Nubase 0.1.4 and earlier (reporter says current main too) serves GET and DELETE on /storage/v1/object/{bucketId}/{path} with no apikey or JWT. Tenant resolves from the subdomain and the bucket's private flag is never checked. Anyone who knows tenant subdomain, bucket id and object path can read or delete private objects. No fixed release found.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running OtterMind Nubase 0.1.4 or earlier that store private files in Nubase storage buckets. The sources do not say whether managed hosting is affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Nubase | vendor | <= 0.1.4 | – |
0.1.4 (docker image ottermind/nubase:0.1.4 or earlier)? Then you are exposedv0.1.4 is the latest tag and the reporter says main is also affected0.1.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
This page as .md · .json · in your agent: get_signal("CVE-2026-111701")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.