CVE-2026-119710
Received Received - Intake

Event Type Injection in PipesHub

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119710
EUVD
EUVD-2026-114115

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pipeshub-ai pipeshub-ai 0.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PipesHub 0.3.0 before 0.10.0 has an event type injection flaw. Authenticated users with the crawl:write scope can delete connectors by injecting malicious values into the :connector path segment. For example, sending a value like web.delete to the schedule route bypasses proper checks and allows deletion of connector instances and purging of record embeddings.

Impact Analysis

This vulnerability allows attackers to delete critical connector instances and remove embedded records. For users, this could mean loss of data pipelines, disrupted workflows, or unauthorized removal of integrations. Businesses relying on PipesHub for data processing may face operational disruptions or data loss.

Mitigation Strategies

Upgrade PipesHub to version 0.10.0 or later to address the event type injection vulnerability. Ensure only authorized users with appropriate scopes can access administrative functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119710. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart