CVE-2026-111671: Cube-studio: IDOR lets users disrupt others' services

HIGH

Published October 16, 2026

CISO Take

Cube-studio, an open-source MLOps platform, has an insecure direct object reference flaw (CVE-2026-111671, CWE-639) in its notebook and model-serving lifecycle endpoints. Any authenticated low-privilege user can pass sequential IDs to stop, reset, clear or redeploy other users' notebooks and inference services, deleting pods and taking production endpoints offline. Exploitation needs no user interaction and is trivial to script, though there is no public exploit, Nuclei template, KEV listing or EPSS data yet, and the CVSS score of 7.1 is driven by availability impact. No patched version is identified (affects versions through 2026.09.01), so tenants running shared Cube-studio clusters should restrict platform access to trusted users, add ownership checks or a reverse-proxy block on the affected lifecycle endpoints, and monitor for unexpected pod deletions and sequential-ID requests.

Sources:NVDATLASVulnCheckhackmd.ioGitHub (data-infra/cube-studio source)

What is the risk?

High (CVSS 7.1). Network-reachable, low complexity, low privileges, no user interaction. Impact is limited to integrity (low) and availability (high), with no confidentiality loss. Risk is highest in multi-tenant deployments where many users share one Cube-studio instance and where it fronts production inference. Exploitation is expected to be trivial because ids are sequential, but no public exploit, scanner template or KEV listing exists and EPSS is unavailable. Package footprint and dependent data are unknown, and no fixed version has been identified.

How does the attack unfold?

Initial Access

Attacker logs in to Cube-studio with any valid low-privilege account.

AML.T0012

Exploitation

Attacker calls notebook and serving lifecycle endpoints with sequential ids belonging to other users, bypassing missing ownership checks.

AML.T0049

Impact

Victim pods are deleted or redeployed, taking production inference endpoints and notebooks offline.

AML.T0029

Initial Access

Attacker logs in to Cube-studio with any valid low-privilege account.

AML.T0012

Exploitation

Attacker calls notebook and serving lifecycle endpoints with sequential ids belonging to other users, bypassing missing ownership checks.

AML.T0049

Impact

Victim pods are deleted or redeployed, taking production inference endpoints and notebooks offline.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
cube-studio	—	—	No patch

Do you use cube-studio? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

ILow

AHigh

What should I do?

1 step

1) Check the vendor repository (data-infra/cube-studio) for a fix newer than 2026.09.01 and upgrade when available. 2) Until patched, limit platform accounts to trusted users and remove untrusted or self-registered users. 3) Add a reverse proxy or WAF rule restricting the notebook, inferenceserving and serving stop/reset/clear/deploy endpoints, or apply a code patch that verifies the requesting user owns or is authorized for the object id. 4) Apply Kubernetes RBAC and namespace isolation so the platform service account cannot indiscriminately delete pods across tenants. 5) Detect by alerting on lifecycle API calls by users against objects they do not own, runs of sequential ids from one account, and unexpected pod deletions or restarts of inference services. 6) Set up availability monitoring and automatic redeploy for critical production endpoints.

How is it classified?

Auth BypassDoSFrameworkInferenceAML.T0012- Valid Accounts AML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application AML.T0101- Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-111671?

Is CVE-2026-111671 actively exploited?

No confirmed active exploitation of CVE-2026-111671 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-111671?

1) Check the vendor repository (data-infra/cube-studio) for a fix newer than 2026.09.01 and upgrade when available. 2) Until patched, limit platform accounts to trusted users and remove untrusted or self-registered users. 3) Add a reverse proxy or WAF rule restricting the notebook, inferenceserving and serving stop/reset/clear/deploy endpoints, or apply a code patch that verifies the requesting user owns or is authorized for the object id. 4) Apply Kubernetes RBAC and namespace isolation so the platform service account cannot indiscriminately delete pods across tenants. 5) Detect by alerting on lifecycle API calls by users against objects they do not own, runs of sequential ids from one account, and unexpected pod deletions or restarts of inference services. 6) Set up availability monitoring and automatic redeploy for critical production endpoints.

What systems are affected by CVE-2026-111671?

This vulnerability affects the following AI/ML architecture patterns: model serving, MLOps platforms, notebook environments, Kubernetes-based inference, multi-tenant ML platforms.

What is the CVSS score for CVE-2026-111671?

CVE-2026-111671 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

model servingMLOps platformsnotebook environmentsKubernetes-based inferencemulti-tenant ML platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

AML.T0101Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.

Exploitation Scenario

An attacker with a low-privilege Cube-studio account, such as a trial or contractor user, authenticates and calls the lifecycle endpoints for notebooks and inference services with incrementing numeric ids. Because the endpoints do not check object ownership, each request stops or redeploys another team's resources and deletes their pods. The attacker loops over the id range to take down all production inference endpoints on the shared cluster, or to wipe other users' notebook environments, causing an outage and lost work with minimal effort and no exploit tooling.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.