Cube Studio
Monthly
Cube-studio instances through version 2026.09.01 let any authenticated, low-privileged user act on other tenants' notebooks and inference services by supplying another user's object id to lifecycle endpoints (stop, reset, clear, redeploy) in view_notebook.py, view_inferenceserving.py and view_serving.py, allowing pod deletion and taking production inference endpoints offline. The CVSS 4.0 score of 7.1 (PR:L, VI:L, VA:H, VC:N) and CWE-639 classification describe a bounded cross-tenant authorization flaw in the data-infra/cube-studio product rather than a confidentiality breach. No public exploit code or active exploitation has been confirmed (no public exploit identified at time of analysis), though a public technical writeup describing the IDOR exists.
Authenticated, low-privilege users of Cube-studio through 2026.09.01 can read or clone pipelines belonging to other project groups by enumerating sequential pipeline IDs through the web, log, monitoring, pod, and copy_pipeline endpoints, exposing DAG definitions, Kubernetes cluster names, namespaces, Argo workflow IDs, and pod names. Classified as an authorization bypass through a user-controlled key (CWE-639) and scored CVSS 5.3 (CVSS:4.0 AV:N/AC:L/PR:L/UI:N/VC:L), the issue requires a valid low-privilege account in a multi-tenant deployment where multiple project groups coexist, and its impact is confined to cross-group metadata disclosure and pipeline cloning - no code execution, system compromise, or modification of existing data is enabled. No public exploit identified at time of analysis; risk is highest in shared, multi-tenant installations and negligible in single-group deployments where there is nothing to enumerate.
Cube-studio instances through version 2026.09.01 let any authenticated, low-privileged user act on other tenants' notebooks and inference services by supplying another user's object id to lifecycle endpoints (stop, reset, clear, redeploy) in view_notebook.py, view_inferenceserving.py and view_serving.py, allowing pod deletion and taking production inference endpoints offline. The CVSS 4.0 score of 7.1 (PR:L, VI:L, VA:H, VC:N) and CWE-639 classification describe a bounded cross-tenant authorization flaw in the data-infra/cube-studio product rather than a confidentiality breach. No public exploit code or active exploitation has been confirmed (no public exploit identified at time of analysis), though a public technical writeup describing the IDOR exists.
Authenticated, low-privilege users of Cube-studio through 2026.09.01 can read or clone pipelines belonging to other project groups by enumerating sequential pipeline IDs through the web, log, monitoring, pod, and copy_pipeline endpoints, exposing DAG definitions, Kubernetes cluster names, namespaces, Argo workflow IDs, and pod names. Classified as an authorization bypass through a user-controlled key (CWE-639) and scored CVSS 5.3 (CVSS:4.0 AV:N/AC:L/PR:L/UI:N/VC:L), the issue requires a valid low-privilege account in a multi-tenant deployment where multiple project groups coexist, and its impact is confined to cross-group metadata disclosure and pipeline cloning - no code execution, system compromise, or modification of existing data is enabled. No public exploit identified at time of analysis; risk is highest in shared, multi-tenant installations and negligible in single-group deployments where there is nothing to enumerate.