CVE-2026-119710— PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route

Quick assessment

Affected

pipeshub-ai pipeshub-ai

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PipesHub 0.3.0 至 0.10.0 之前的版本存在事件类型注入漏洞。该漏洞允许仅拥有权限的已认证用户，通过向路径段注入恶意内容来删除连接器。攻击者可以向调度（schedule）路由发送类似的值，从而绕过和锁检查，进而删除连接器实例并清除记录嵌入（record embeddings）。

CVSS 7.1 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1552 · Unsecured Credentials T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route

Source: CVE Program / CVE List V5

Vulnerability Description

PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pipeshub-ai	pipeshub-ai	0.3.0 ~ 0.10.0	-

II. Public POCs for CVE-2026-119710

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119710

请登录查看更多情报信息。

Other References for CVE-2026-119710 (6)

https://github.com/pipeshub-ai/pipeshub-ai/commit/967232f4cb0fc2d0da5ebc30990417a349d6c56a patch
https://github.com/pipeshub-ai/pipeshub-ai product
https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/nodejs/apps/src/modules/crawling_manager/utils/utils.ts technical-description
https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0 release-notes
https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-cwp5-6php-hrgx vendor-advisory
https://www.vulncheck.com/advisories/pipeshub-0.3.0-before-0.10.0-connector-deletion-via-crawling-manager-schedule-route third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119710

Same Patch Batch · pipeshub-ai · 2026-10-30 · 3 CVEs total

CVE-2026-119712	6.4 MEDIUM	PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
CVE-2026-119711	5.3 MEDIUM	PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header

IV. Related Vulnerabilities

Same product: pipeshub-ai

Same vendor: pipeshub-ai

Same weakness: CWE-862