目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2026-68746— Livebook 异常处理不当漏洞

一分钟漏洞结论

影响对象
livebook-dev livebook
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Livebook是Livebook组织开源的一款用于编写交互式协作代码笔记本的 Web 应用程序。 Livebook 0.19.7版本至0.19.9之前版本存在异常处理不当漏洞，该漏洞源于身份验证失败时处理不当，无法区分无法解析的部署组与身份强制关闭的情况，可能导致未经身份验证的网络客户端获得完全访问权限，包括读取笔记本和配置的密钥、在服务器运行时执行代码及破坏其运行。

CVSS 7.7 · High EPSS 0.80% · P56

影响版本矩阵 4

厂商产品 版本范围状态
livebook-dev livebook 0.19.7< 0.19.9 affected
0.19.7< 0.19.9 affected
0.19.7-cuda12< 0.19.9-cuda12 affected
fc2c87c6b0276705281842acbe17142d1ac4d555< * affected
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-68746 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access
来源: CVE Program / CVE List V5
Vulnerability Description
Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the deployment group it belongs to, and resolves that identifier against a locally cached list of deployment groups on every request in order to decide whether Teams identity enforcement is active. Livebook.Hubs.TeamClient.handle_call/3 in lib/livebook/hubs/team_client.ex does not distinguish a deployment group that could not be resolved from one that was resolved with identity enforcement switched off: the clause matches only the case where a group was found with enforcement enabled, and falls through to a catch-all that reports enforcement as switched off for everything else. The two neighbouring functions that decide user and application access resolve the same identifier and treat the same unresolved result as a denial. When the identity status is reported as switched off, Livebook.ZTA.LivebookTeams.authenticate/3 in lib/livebook/zta/livebook_teams.ex returns empty identity metadata and allows the request to continue instead of halting it. LivebookWeb.UserPlug.build_current_user/3 merges that empty metadata into a newly built user, whose access type defaults to full access, and LivebookWeb.AuthPlug.authorized?/1 grants access to any user holding full access. The cached identifier becomes unresolvable when the deployment group it refers to is deleted while the agent is not connected to receive the change, most concretely when a deployment group is deleted during the window in which an agent is disconnected or reconnecting. The client removes the group from its cached list without clearing the identifier that refers to it. Any client able to reach the affected server over the network is then granted the same access as a fully privileged member of the organisation, including the ability to read notebooks and configured secrets, execute code on the server's runtime, and disrupt its operation. This issue affects livebook: from 0.19.7 before 0.19.9.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
未能安全地进行程序失效(Failing Open)
来源: CVE Program / CVE List V5
Vulnerability Title
Livebook 异常处理不当漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Livebook是Livebook组织开源的一款用于编写交互式协作代码笔记本的 Web 应用程序。 Livebook 0.19.7版本至0.19.9之前版本存在异常处理不当漏洞，该漏洞源于身份验证失败时处理不当，无法区分无法解析的部署组与身份强制关闭的情况，可能导致未经身份验证的网络客户端获得完全访问权限，包括读取笔记本和配置的密钥、在服务器运行时执行代码及破坏其运行。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD

受影响产品

厂商 产品 影响版本 CPE 订阅
livebook-dev livebook 0.19.7 ~ 0.19.9 cpe:2.3:a:livebook-dev:livebook:*:*:*:*:*:*:*:*
livebook-dev livebook 0.19.7 ~ 0.19.9 cpe:2.3:a:livebook-dev:livebook:*:*:*:*:*:*:*:*
livebook-dev livebook fc2c87c6b0276705281842acbe17142d1ac4d555 ~ * cpe:2.3:a:livebook-dev:livebook:*:*:*:*:*:*:*:*

二、漏洞 CVE-2026-68746 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级
Qwen3.6-35B-A3B · 5312 chars
Pro+ 专属包含：
漏洞复现靶场录像（真实沙箱构建 + 触发，独家）
漏洞原理深度分析
触发条件与影响面
完整可执行 POC 代码
利用链与缓解建议
POC 打包下载
每月 100+ 条 AI 生成额度

三、漏洞 CVE-2026-68746 的情报信息

请登录查看更多情报信息。

CVE-2026-68746 补丁与修复 (3)

CVE-2026-68746 厂商安全公告 (2)

CVE-2026-68746 新闻报道 (1)

同批安全公告 · livebook-dev · 2026-08-05 · 共 5 条

CVE-2026-66298 8.6 HIGH Livebook 输入验证错误漏洞
CVE-2026-66881 7.0 HIGH Livebook 路径遍历漏洞
CVE-2026-66885 6.8 MEDIUM Livebook 跨站请求伪造漏洞
CVE-2026-66297 5.0 MEDIUM Livebook 命令注入漏洞

IV. Related Vulnerabilities

Same product: livebook
Same vendor: livebook-dev
Same weakness: CWE-636