Which versions of Taubyte Tau are affected by EUVD-2026-56903?

Taubyte Tau v1.1.10 contains a critical multi-tenant isolation vulnerability allowing any authenticated GitHub user to read or permanently delete projects belonging to other tenants.. A patch is available.

How to fix or mitigate EUVD-2026-56903?

Within 24 hours, identify all systems running Taubyte Tau v1.1.10 and assess which are internet-exposed or contain sensitive data. Within 7 days, deploy the vendor-released patch to all instances, prioritizing production and customer-facing environments. Within 30 days, complete patching across all remaining systems, audit access logs from the past 90 days for suspicious cross-tenant project access or deletion patterns, and conduct security validation to confirm tenant isolation is fully restored.

Taubyte Tau EUVD-2026-56903

Q: What is the CVSS score of EUVD-2026-56903?

EUVD-2026-56903 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-69119 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-11 VulnCheck

GHSA-gq8x-2577-rmx8

Authentication Bypass Tau

7.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

PR:L because any valid GitHub OAuth token suffices; I:H and A:H reflect permanent cross-tenant project deletion; C:L for readable project metadata exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 11, 2026 - 20:13 vuln.today

Analysis Generated

Aug 11, 2026 - 20:13 vuln.today

CVE Published

Aug 11, 2026 - 18:36 cve.org

HIGH 7.2

DescriptionCVE.org

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/{id} endpoints. The GitHubTokenHTTPAuth middleware only validates that a caller presents a valid GitHub OAuth token without verifying ownership or access rights to the target project, enabling attackers with any valid GitHub token to invoke bare KV-store operations such as projects.Fetch and project.Delete against any project ID to achieve cross-tenant project takeover.

AnalysisAI

Cross-tenant project takeover in Taubyte Tau v1.1.10 enables any authenticated GitHub user to read or permanently delete projects belonging to other tenants by supplying arbitrary project IDs to the GET and DELETE /projects/{id} HTTP endpoints. The GitHubTokenHTTPAuth middleware performs only token validity checks, exposing bare KV-store operations (projects.Fetch and project.Delete) to any caller holding a valid GitHub OAuth token without verifying project ownership. No public exploit exists and SSVC confirms no observed exploitation, but the low-privilege requirement (any GitHub account) combined with permanent data destruction capability makes this a critical multi-tenant isolation failure for any exposed Tau deployment.

Technical ContextAI

The affected component is the services/auth HTTP service in Taubyte Tau (CPE: cpe:2.3:a:taubyte:tau:*:*:*:*:*:*:*:*), an open-source cloud-native computing platform. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a classic IDOR variant where access control relies on user-supplied object identifiers without ownership verification. The GitHubTokenHTTPAuth middleware confirmed a caller's GitHub OAuth token was valid but did not check whether that caller owned or had any rights to the project ID supplied in the URL path. Handlers for GET /projects/{id} and DELETE /projects/{id} passed the caller-controlled {id} directly to KV-store operations (projects.Fetch and project.Delete). The patch at commit f5c9c9c311a1ff156814e0c81f186bfd101ec237 introduces an authorizeProject() function that checks the caller's GitHub permissions (admin, maintain, or push) on the project's linked repositories via the GitHub API before allowing any project-level operation, and deliberately returns a generic 'project not found' error to unauthorized callers to prevent the endpoint from becoming a project-existence oracle.

RemediationAI

Upgrade to a Taubyte Tau build that incorporates commit f5c9c9c311a1ff156814e0c81f186bfd101ec237 (https://github.com/taubyte/tau/commit/f5c9c9c311a1ff156814e0c81f186bfd101ec237), which adds ownership enforcement to GET /projects/{id} and DELETE /projects/{id} via the new authorizeProject() function. The exact fixed release tag is not independently confirmed from available data - verify against the GitHub release page (https://github.com/taubyte/tau) or the VulnCheck advisory before deploying. As a compensating control pending patch deployment, restrict network access to the Tau auth service HTTP API so that the /projects/{id} endpoints are reachable only from trusted internal networks or authenticated administrative sessions, preventing arbitrary GitHub OAuth token holders from reaching the vulnerable routes. Note that this network restriction may disrupt legitimate multi-tenant workflows that rely on external token-based project access, so test against your deployment topology before applying. If running in development mode (devMode enabled), note that the patch explicitly skips authorization checks in that mode - production deployments must ensure devMode is disabled.