CVE-2026-75109: Determined Missing Authorization Check on Generic Task Endpoints
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-75109?
The severity of CVE-2026-75109 is high with a score of 7.1.
What is CVE-2026-75109 about?
CVE-2026-75109 involves a missing authorization check on generic task endpoints, allowing authenticated attackers to disrupt workloads.
How do I fix CVE-2026-75109?
To fix CVE-2026-75109, implement proper authorization checks on the task kill, pause, and unpause endpoints.
Who is affected by CVE-2026-75109?
Authenticated users can be affected by CVE-2026-75109 if they can disrupt others' tasks without proper authorization.
What are the potential risks associated with CVE-2026-75109?
The potential risks associated with CVE-2026-75109 include unauthorized termination, pausing, or unpausing of tasks, leading to disrupted workloads.