Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111672Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in cube-studio from data-infra. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 73.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.

Affected products (as reported)

Vendor	Product	Versions
data-infra	cube-studio	0 – through 2026.09.01

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@hieuPenguinnn/cube-studio-idor-expose-api-lifecycle third-party-advisory
https://github.com/data-infra/cube-studio/blob/v2026.09.01/myapp/views/view_pipeline.py#L1144-L1268 technical-description
VulnCheck Advisory: Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints third-party-advisory