Vulnerability · Published Jun 17, 2026 · Assigned by GitHub_M

CVE-2026-54533vantage6 node has an Improper Access Control issue

Medium 6.9

In plain English

A medium-severity improper access control in vantage6 from vantage6. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access other algorithms input and output files. Version 5.0.0 fixes the issue. As a workaround, verify and restrict the algorithm containers that are allowed to run on the node.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	vantage6	5.0.0	GHSA-x9f6-9rvm-mmrg
PyPI	vantage6	5.0.0	PYSEC-2026-3401

Affected products (as reported)

Vendor	Product	Versions
vantage6	vantage6	< 5.0.0

Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/vantage6/vantage6/security/advisories/GHSA-x9f6-9rvm-mmrg x_refsource_CONFIRM
https://github.com/vantage6/vantage6/issues/1932 x_refsource_MISC
https://docs.vantage6.ai/usage/running-the-node/security x_refsource_MISC
https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500 x_refsource_MISC