CVE-2026-111672
Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.
| CWE | CWE-639 |
| Vendor | data-infra |
| Product | cube-studio |
| Published | Oct 16, 2026 |
| Last Updated | Oct 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for data-infra cube-studio
Be the first to know when new medium vulnerabilities affecting data-infra cube-studio are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
data-infra / cube-studio
0 ≤ 2026.09.01
References
hackmd.io: https://hackmd.io/@hieuPenguinnn/cube-studio-idor-expose-api-lifecycle github.com: https://github.com/data-infra/cube-studio/blob/v2026.09.01/myapp/views/view_pipeline.py#L1144-L1268 vulncheck.com: https://www.vulncheck.com/advisories/cube-studio-through-2026.09.01-idor-via-pipeline-view-and-copy-endpoints
Credits
hieuPenguinnn