CVE-2026-111671

LOWCVSS 7.1 · HIGH

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

DFIR Lab@DFIR_Lab20h
🚨 HIGH: CVE-2026-111671 (CVSS 7.1) - Cube-studio ≤2026.09.01 IDOR flaw lets authenticated users stop/delete other users' notebooks & production inference endpoints. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/NiG3ew0V41
0000027
153 followersView on X

Explore more

Back to dashboard