Vulnerabilidades de Data-infra
CVEs publicadas que afetam produtos de Data-infra: 2 registro(s), com severidade, exploração e correções.
CVE-2026-111672
Média · 4.3
CWE-639 16/10/2026
Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.
CVE-2026-111671
Alta · 7.1
CWE-639 16/10/2026
Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.