CVE-2026-75109

Received Received - Intake

Authenticated Task Disruption in Determined AI Platform

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-75109

EUVD

EUVD-2026-60388

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Determined allows authenticated attackers to disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own. The issue stems from a failure to properly authorize requests on generic task kill, pause, and unpause API endpoints.

Detection Guidance

Detecting this vulnerability requires monitoring API endpoints for unauthorized task modifications. Check logs for unusual activity on generic task kill, pause, or unpause endpoints. Look for requests from authenticated users targeting tasks they do not own.

Impact Analysis

If you use Determined, an attacker with authenticated access could disrupt your active tasks by killing, pausing, or unpausing them without permission. This could lead to data loss, interrupted workflows, or degraded performance of your workloads.

Compliance Impact

This vulnerability allows authenticated attackers to disrupt workloads by terminating, pausing, or unpausing tasks they do not own. This could lead to unauthorized modifications of data or system states, potentially violating integrity and access control requirements in standards like GDPR and HIPAA.

Mitigation Strategies

Immediately restrict access to task modification endpoints to authorized users only. Implement strict ownership validation for task operations. Update Determined to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-75109. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70