CVE-2026-111672
Received Received - Intake

Cube Studio Missing Authorization Lets Authenticated Users Access Other Project Pipelines

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111672
EUVD
EUVD-2026-102963

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
data-infra cube-studio 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Cube-studio through 2026.09.01 has a missing authorization vulnerability in myapp/views/view_pipeline.py. Authenticated users can view or copy pipelines from other project groups by guessing sequential pipeline IDs. This exposes sensitive data like DAGs, cluster names, namespaces, Argo workflow IDs, and pod names.

Detection Guidance

Check Cube-studio endpoints for unauthorized access to pipeline data. Monitor web, log, monitoring, pod, and copy_pipeline endpoints for sequential pipeline ID enumeration. Review access logs for unusual requests to myapp/views/view_pipeline.py.

Impact Analysis

An attacker with access could enumerate and access other users' pipelines, exposing sensitive workflow details. This may lead to data leaks, unauthorized access to workflow configurations, or potential disruption of operations if pipelines are cloned or modified.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations may face compliance breaches if exposed data includes regulated information.

Mitigation Strategies

Update Cube-studio to the latest version. Implement strict access controls to restrict authenticated user permissions. Disable or monitor the affected endpoints until patched. Review and restrict project group access to pipelines.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111672. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart