CVE-2026-111671
Last modified
CVE-2026-111671 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline..
Description
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| data-infra | cube-studio | <= 2026.09.01 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-111671?
How severe is CVE-2026-111671?
How do I fix CVE-2026-111671?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-111666Steedos Platform through 3.0.15-beta.51 contains an authoriz…4.3
- CVE-2026-111667REBUILD through 4.5.0 contains a missing authorization vulne…4.3
- CVE-2026-111668AIHelms through 0.1.25 contains a missing authorization vuln…5.4
- CVE-2026-111669ZR.Admin.NET through 3.8.2 contains an sql injection vulnera…6.5
- CVE-2026-11167Inappropriate implementation in WebView in Google Chrome on …9.6
- CVE-2026-111670ClickVisual through 1.1.2 contains a missing authorization v…4.3
- CVE-2026-111672Cube-studio through 2026.09.01 contains a missing authorizat…4.3
- CVE-2026-111673IceCMS through 4.1.5 contains a missing authentication vulne…9.8
- CVE-2026-111674Tbed through 20240319 contains a missing authorization vulne…4.3
- CVE-2026-111675Course-tencent-cloud through 2.0.1 contains an improper rest…7.4
- CVE-2026-111676Faveo Helpdesk through 2.0.3 contains a broken access contro…4.3
- CVE-2026-111677Antiword through 0.37 contains a heap out-of-bounds read vul…5.5
Are you affected by CVE-2026-111671?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST