EUVD-2026-53599Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required timing precondition (group deleted during disconnect window); once triggered, exploitation requires no authentication per the description, so PR:N.
Primary rating from Vendor (6b3ad84c-e1a6-4bf7-a703-f496b71e49db).
CVSS VectorVendor: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Lifecycle Timeline
4DescriptionCVE.org
Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams.
A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the deployment group it belongs to, and resolves that identifier against a locally cached list of deployment groups on every request in order to decide whether Teams identity enforcement is active. Livebook.Hubs.TeamClient.handle_call/3 in lib/livebook/hubs/team_client.ex does not distinguish a deployment group that could not be resolved from one that was resolved with identity enforcement switched off: the clause matches only the case where a group was found with enforcement enabled, and falls through to a catch-all that reports enforcement as switched off for everything else. The two neighbouring functions that decide user and application access resolve the same identifier and treat the same unresolved result as a denial.
When the identity status is reported as switched off, Livebook.ZTA.LivebookTeams.authenticate/3 in lib/livebook/zta/livebook_teams.ex returns empty identity metadata and allows the request to continue instead of halting it. LivebookWeb.UserPlug.build_current_user/3 merges that empty metadata into a newly built user, whose access type defaults to full access, and LivebookWeb.AuthPlug.authorized?/1 grants access to any user holding full access.
The cached identifier becomes unresolvable when the deployment group it refers to is deleted while the agent is not connected to receive the change, most concretely when a deployment group is deleted during the window in which an agent is disconnected or reconnecting. The client removes the group from its cached list without clearing the identifier that refers to it. Any client able to reach the affected server over the network is then granted the same access as a fully privileged member of the organisation, including the ability to read notebooks and configured secrets, execute code on the server's runtime, and disrupt its operation.
This issue affects livebook: from 0.19.7 before 0.19.9.
AnalysisAI
Full unauthenticated access to Livebook 0.19.7-0.19.9 is possible when a Livebook Agent or App Server's deployment group is deleted from Livebook Teams while the agent is temporarily disconnected. A logic error in Livebook.Hubs.TeamClient.handle_call/3 causes the zero-trust authentication layer to treat an unresolvable cached deployment group identifier identically to one with identity enforcement deliberately disabled, allowing any network-reachable client to read notebooks and secrets, execute code on the server runtime, and disrupt operations without authentication. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the high confidentiality, integrity, and availability impact (CVSS 4.0: 7.7) warrants prompt patching for all Teams-connected deployments.
Technical ContextAI
Livebook is an Elixir-based interactive notebook platform. When deployed as an Agent or App Server under Livebook Teams, it caches both the identifier of its deployment group and a local list of all deployment groups; on every incoming request, it resolves the cached identifier against this local list to decide whether Teams identity enforcement is active. The root cause is CWE-636 (Not Failing Securely - Failing Open): Livebook.Hubs.TeamClient.handle_call/3 in lib/livebook/hubs/team_client.ex only matches the case where a group is found with enforcement explicitly enabled. All other outcomes, including the critical 'identifier present but group absent from cache' case, fall through to a catch-all that reports enforcement as switched off. This causes Livebook.ZTA.LivebookTeams.authenticate/3 in lib/livebook/zta/livebook_teams.ex to return empty identity metadata rather than halting the request; LivebookWeb.UserPlug.build_current_user/3 then merges that empty metadata into a newly constructed user whose default access type is full access, and LivebookWeb.AuthPlug.authorized?/1 grants passage. The commit diff confirms that the fix narrows the catch-all to the explicit 'disabled' case and routes the unresolvable-group path to a :pending return (mirroring the pre-connected state), blocking all access until the group can be confirmed.
RemediationAI
Upgrade Livebook to version 0.19.9 or later, which corrects the fail-open logic by changing the catch-all clause in Livebook.Hubs.TeamClient.handle_call/3 to return :pending when a deployment group identifier cannot be resolved, blocking access until the group can be confirmed rather than silently permitting it. The fix is implemented across three commits (2d3a2c7, d374e90, d6d0dfa) referenced in the vendor advisory at https://github.com/livebook-dev/livebook/security/advisories/GHSA-74j5-6grg-g6wj. Prior to patching, restrict network access to Livebook Agent and App Server endpoints to known-trusted IP ranges using firewall or reverse-proxy ACLs, preventing opportunistic exploitation during any exposure window - note this does not prevent exploitation by an already-trusted internal attacker. Operationally, avoid deleting deployment groups while agents are known to be disconnected or in a reconnection loop; where possible, ensure agents have fully reconnected and their caches refreshed before initiating group deletions. Neither compensating control eliminates the underlying logic flaw.
Livebook is a web application for writing interactive and collaborative code notebooks. Rated critical severity (CVSS 9.
Untrusted JavaScript rendered in Livebook notebook outputs can escape the sandboxed cross-origin iframe and trigger sess
Path traversal in Livebook's notebook import pipeline allows an attacker who supplies a crafted `.livemd` file to write
Session hijacking via OAuth CSRF in Livebook's Livebook Teams identity provider allows an organization-member attacker t
Remote command injection in livebook-dev Livebook's deployment setup command generator allows an authenticated high-priv
Same weakness CWE-636 – Not Failing Securely ('Failing Open')
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today