Live › vulnerability › CVE-2026-119710
PipesHub versions 0.3.0 before 0.10.0 let a user holding only the crawl:write scope delete connector instances by injecting a crafted value into the connector path segment of the schedule route. The injected value also bypasses the connector:delete permission and lock checks, so the attacker can remove connectors and purge record embeddings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Deployments of PipesHub in the 0.3.0 to 0.9.x range where users or tokens hold the crawl:write scope. The flaw needs an authenticated account, so instances without such accounts have less exposure. Teams can skip it if they run 0.10.0 or later.
No product ranges from the sources yet.
0.3.0 through 0.9.x are in the affected range according to the description.0.10.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings.
This page as .md · .json · in your agent: get_signal("CVE-2026-119710")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.