CVE-2026-20703 · Package
NO FIX YET · SEE WHAT TO DO
BigDL versions before 2.4.0 have a protection mechanism failure in user applications running in Ring 3 that can allow privilege escalation. An attacker with local access and an unprivileged foothold may be able to gain higher privileges on the affected system.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run BigDL on shared or multi-user machines where untrusted local code can execute alongside privileged users. The description's Ring 3 wording points to user-mode applications, so systems that only run BigDL in isolated single-user environments are less exposed. unknown for exact configuration requirements.
Not affected if single-user-machine, version-2.4.0-or-later
Who cares bigdl, local-compute, python
pip show bigdl or the version file in your environment); versions below 2.4.0 are in scope.2.4.0 or laterProtection mechanism failure for some BigDL before version 2.4.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.