CVE-2026-111672: Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

Q: Who can exploit this issue?

An authenticated Cube-studio user with low privileges can exploit it. The attacker needs to know or enumerate pipeline IDs; sequential IDs can be enumerated through the affected endpoints.

Q: What information or actions are exposed?

The affected endpoints can disclose pipelines and associated DAGs, cluster names, namespaces, Argo workflow IDs, and pod names belonging to other project groups. The copy_pipeline endpoint can also be used to clone another group's pipeline.

Q: Which endpoints should be reviewed for exposure?

Review authorization behavior for the web, log, monitoring, pod, and copy_pipeline endpoints in myapp/views/view_pipeline.py. These endpoints are identified as allowing access to other project groups' pipelines by ID.

Q: How can defenders determine whether they may be affected?

Cube-studio versions through 2026.09.01 are identified as affected. Check whether authenticated users can request pipeline records or related web, log, monitoring, pod, or copy endpoints using IDs belonging to a different project group.

Published Oct 16, 2026

Updated

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/viewpipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copypipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.

Affected Software

1 affected component

Cube-studio Cube-studio<=2026.09.01

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Cube-studio user with low privileges can exploit it. The attacker needs to know or enumerate pipeline IDs; sequential IDs can be enumerated through the affected endpoints.

What information or actions are exposed?

The affected endpoints can disclose pipelines and associated DAGs, cluster names, namespaces, Argo workflow IDs, and pod names belonging to other project groups. The copy_pipeline endpoint can also be used to clone another group's pipeline.

Which endpoints should be reviewed for exposure?

Review authorization behavior for the web, log, monitoring, pod, and copy_pipeline endpoints in myapp/views/view_pipeline.py. These endpoints are identified as allowing access to other project groups' pipelines by ID.

How can defenders determine whether they may be affected?

Cube-studio versions through 2026.09.01 are identified as affected. Check whether authenticated users can request pipeline records or related web, log, monitoring, pod, or copy endpoints using IDs belonging to a different project group.

CVE-2026-111672: Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information or actions are exposed?

Which endpoints should be reviewed for exposure?

How can defenders determine whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information or actions are exposed?

Which endpoints should be reviewed for exposure?

How can defenders determine whether they may be affected?