---
id: "CVE-2026-111701"
kind: "vulnerability"
aliases: ["CVE-2026-111701"]
title: "OtterMind Nubase: unauthenticated access to private storage bucket objects"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Nubase", "fixed": [], "affected": "<= 0.1.4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["missing-authentication", "multi-tenant", "nubase", "other", "self-hosted", "storage", "supabase-compatible-storage"]
not_affected_if: ["no-private-bucket-data", "not-internet-reachable", "not-using-storage", "unknown"]
published_at: "2026-10-16T18:17:53+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:44:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111701", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:44:49+00:00"}]
---

# OtterMind Nubase: unauthenticated access to private storage bucket objects

OtterMind Nubase 0.1.4 and earlier (reporter says current main too) serves GET and DELETE on /storage/v1/object/{bucketId}/{path} with no apikey or JWT. Tenant resolves from the subdomain and the bucket's private flag is never checked. Anyone who knows tenant subdomain, bucket id and object path can read or delete private objects. No fixed release found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Nubase affected <= 0.1.4 fixed ?

## How to check

Run a self-hosted Nubase <= 0.1.4 (docker image ottermind/nubase:0.1.4 or earlier)? Then you are exposed. Test: from outside, request GET https://<tenant-subdomain>/storage/v1/object/<private-bucket>/<known-object> with no apikey or Authorization header. A 200 with file content means exposed. Check access logs for unauthenticated GET/DELETE on /storage/v1/object/ paths that are not public/, authenticated/, sign/, upload/, info/, list/, move or copy.

## Fix

No fixed release as of 2026-10-25: v0.1.4 is the latest tag and the reporter says main is also affected. Until a fix ships: block or require auth at your reverse proxy/WAF for /storage/v1/object/* except /public/ and /authenticated/ paths (at least DELETE), keep Nubase off the public internet where possible, and use the /object/authenticated/ route. Watch github.com/OtterMind/Nubase for a release after 0.1.4.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111701
- 2026-10-25T03:44:49+00:00 analyst — Read VulnCheck advisory, NVD, reporter write-up (hackmd, source-review only, not executed) and GitHub releases. No fixed release exists: v0.1.4 is latest, reporter says main at dce7177 is also affected; SECURITY.md says fixes land on main only. Nothing marked verified (no vendor advisory). No public exploitation seen.

## Documents

- [advisory] VulnCheck: OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API https://www.vulncheck.com/advisories/ottermind-nubase-through-0.1.4-missing-authentication-in-storage-object-api
- [describes] Nubase storage default download route serves private-bucket objects without authentication (reporter write-up) https://hackmd.io/@hieuPenguinnn/nubase-storage-private-object-unauth-download
- [mentions] OtterMind/Nubase releases (latest v0.1.4) https://github.com/OtterMind/Nubase/releases

## From the sources

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_