Cube-studio CVE-2026-111672

Requires an authenticated low-privilege Cube-studio account (PR:L) in a multi-tenant deployment where multiple project groups coexist; the attacker exploits that pipeline objects are referenced by sequential, user-controllable ids without an ownership/authorization check across the web, log, monitoring, pod, and copy_pipeline endpoints. Exploitation is limited by the need for valid credentials and by the fact that impact is confined to cross-project-group pipeline metadata disclosure and pipeline cloning - no system compromise, code execution, or data modification is enabled. Risk is highest in shared, multi-tenant installations and negligible in single-tenant/single-group deployments where there are no other project groups to enumerate.

This is a genuine but modest-severity issue best treated as a medium-priority fix rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) correctly reflects a network-exploitable, low-complexity flaw that nonetheless requires an authenticated low-privilege account (PR:L) and yields only limited confidentiality impact (VC:L) with no integrity or availability impact - consistent with CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR). No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no explicit POC/exploit flag was supplied in the input, so there is no signal of active or widespread exploitation. The signals are internally consistent: a low-privilege insider/tenant-isolation weakness in a self-hosted ML platform, not an internet-wide unauthenticated RCE. The main caveat is that a third-party technical write-up (hackmd) and the exact vulnerable source lines are publicly documented, which lowers the effort to develop an exploit even though no weaponized code is confirmed in the provided data - verify POC status independently before deprioritizing.

An authenticated user on one project group in a multi-tenant Cube-studio deployment iterates sequential pipeline ids against the web, log, monitoring, pod, and copy_pipeline endpoints. By doing so they read other project groups' pipeline DAGs, cluster names, namespaces, Argo workflow ids, and pod names, and can clone those pipelines into their own group. The attack path is publicly documented in a hackmd write-up with the vulnerable source referenced, though no packaged exploit is confirmed in the provided data.