CVE-2026-111672— Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

Quick assessment

Affected

data-infra cube-studio

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cube Studio 2026.09.01 及更早版本在中存在一个缺少授权验证的漏洞。该漏洞允许已认证用户通过指定 ID 查看或复制其他项目组的流水线。攻击者可通过 Web、日志、监控、Pod 及等接口枚举连续的流水线 ID，从而泄露有向无环图（DAG）、集群名称、命名空间、Argo 工作流 ID 和 Pod 名称，甚至克隆流水线。

CVSS 4.3 · Medium EPSS 0.33% · P26 Updated Oct 17, 2026

Possible ATT&CK Techniques 2 AI

T1082 · System Information Discovery T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
data-infra	cube-studio	`≤ 2026.09.01`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

Source: CVE Program / CVE List V5

Vulnerability Description

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.

Source: CVE Program / CVE List V5