CVE-2026-68746: auth fail-open grants full server

CISO Take

A logic bug in Livebook's Teams identity enforcement causes the server to silently disable authentication instead of denying access when it can't resolve which deployment group a connected agent belongs to — the classic 'fail open' failure mode, rated CVSS 8.8 (network attack vector, low complexity, no user interaction). Any client that reaches an affected Livebook Agent or App Server during this window is granted the same rights as a fully privileged organization member: reading notebooks and configured secrets, executing arbitrary code on the server's runtime, and disrupting operations. This isn't in CISA KEV, has no public exploit or Nuclei template, sits at TRACK on CISA's SSVC scale, and its EPSS score (0.00447, top 63% percentile) suggests it isn't an active-exploitation emergency — but the impact ceiling (full compromise of a code-execution notebook server) makes it worth prioritizing over its EPSS alone. Upgrade Livebook to 0.19.9 or later on any instance using Livebook Teams immediately; until patched, restrict network reachability to Livebook Agent/App Servers and audit deployment-group deletions for windows where an agent was disconnected or reconnecting, since that's exactly when the cached identifier becomes unresolvable and the fail-open path triggers.

Sources: NVD EPSS GitHub Advisory cna.erlef.org ATLAS

What is the risk?

High-impact, moderate-likelihood risk. Impact is severe: successful exploitation grants an attacker parity with a fully privileged Livebook Teams member — arbitrary code execution on the server's runtime, full read access to notebooks and configured secrets, and the ability to disrupt operations. Exploitability requires a specific precondition (a deployment group deleted while the target agent is disconnected or reconnecting) rather than being exploitable at will, which is reflected in the absence of KEV listing, no known public exploit or scanner template, and a CISA SSVC decision of TRACK rather than Track*/Attend. However, CVSS 8.8 with AV:N/AC:L/UI:N means once the precondition is met, exploitation itself is trivial and requires no user interaction — so any organization running Livebook Teams-enforced agents on network-reachable infrastructure should treat this as a priority patch rather than a backlog item.

How does the attack unfold?

Target identification

Adversary locates a network-reachable Livebook Agent or App Server enforcing Teams identity and identifies or waits for a window in which it is disconnected or reconnecting.

AML.T0006

Fail-open trigger

The deployment group referenced by the agent's cached identifier is deleted during the disconnection window, leaving the identifier unresolvable; the identity-check logic falls through to a catch-all path that reports enforcement as switched off.

Unauthenticated access grant

authenticate/3 returns empty identity metadata, UserPlug builds a user defaulting to full access, and AuthPlug authorizes it — granting the attacker parity with a legitimate privileged member.

AML.T0049

Impact — data theft and code execution

Attacker reads notebooks and configured secrets and executes arbitrary code on the server's runtime, or disrupts server operations.

AML.T0050

Target identification

Adversary locates a network-reachable Livebook Agent or App Server enforcing Teams identity and identifies or waits for a window in which it is disconnected or reconnecting.

AML.T0006

Fail-open trigger

The deployment group referenced by the agent's cached identifier is deleted during the disconnection window, leaving the identifier unresolvable; the identity-check logic falls through to a catch-all path that reports enforcement as switched off.

Unauthenticated access grant

authenticate/3 returns empty identity metadata, UserPlug builds a user defaulting to full access, and AuthPlug authorizes it — granting the attacker parity with a legitimate privileged member.

AML.T0049

Impact — data theft and code execution

Attacker reads notebooks and configured secrets and executes arbitrary code on the server's runtime, or disrupts server operations.

AML.T0050

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Livebook to version 0.19.9 or later immediately on all instances configured with Livebook Teams identity enforcement — this is the only complete fix. 2) Until patched, minimize network exposure of Livebook Agent/App Servers (place behind VPN/firewall, avoid public internet reachability). 3) Audit deployment-group deletion events in Livebook Teams and cross-reference with agent connectivity logs to identify any window where an agent was disconnected or reconnecting at the time of a deletion — this is the trigger condition. 4) After patching, rotate any secrets configured in potentially-exposed deployment groups as a precaution. 5) Monitor for anomalous access patterns on Livebook servers (unexpected user sessions with full-access privileges, notebook reads/executions from unrecognized clients) as a compensating detection control.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Framework AML.T0035 - AI Artifact Collection AML.T0047 - AI-Enabled Product or Service

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MANAGE-2.1 - Mechanisms to manage AI system risk from third-party components

Frequently Asked Questions

What is CVE-2026-68746?

A logic bug in Livebook's Teams identity enforcement causes the server to silently disable authentication instead of denying access when it can't resolve which deployment group a connected agent belongs to — the classic 'fail open' failure mode, rated CVSS 8.8 (network attack vector, low complexity, no user interaction). Any client that reaches an affected Livebook Agent or App Server during this window is granted the same rights as a fully privileged organization member: reading notebooks and configured secrets, executing arbitrary code on the server's runtime, and disrupting operations. This isn't in CISA KEV, has no public exploit or Nuclei template, sits at TRACK on CISA's SSVC scale, and its EPSS score (0.00447, top 63% percentile) suggests it isn't an active-exploitation emergency — but the impact ceiling (full compromise of a code-execution notebook server) makes it worth prioritizing over its EPSS alone. Upgrade Livebook to 0.19.9 or later on any instance using Livebook Teams immediately; until patched, restrict network reachability to Livebook Agent/App Servers and audit deployment-group deletions for windows where an agent was disconnected or reconnecting, since that's exactly when the cached identifier becomes unresolvable and the fail-open path triggers.

Is CVE-2026-68746 actively exploited?

No confirmed active exploitation of CVE-2026-68746 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-68746?

1) Upgrade Livebook to version 0.19.9 or later immediately on all instances configured with Livebook Teams identity enforcement — this is the only complete fix. 2) Until patched, minimize network exposure of Livebook Agent/App Servers (place behind VPN/firewall, avoid public internet reachability). 3) Audit deployment-group deletion events in Livebook Teams and cross-reference with agent connectivity logs to identify any window where an agent was disconnected or reconnecting at the time of a deletion — this is the trigger condition. 4) After patching, rotate any secrets configured in potentially-exposed deployment groups as a precaution. 5) Monitor for anomalous access patterns on Livebook servers (unexpected user sessions with full-access privileges, notebook reads/executions from unrecognized clients) as a compensating detection control.

What systems are affected by CVE-2026-68746?

This vulnerability affects the following AI/ML architecture patterns: notebook-based ML/AI development environments, collaborative model experimentation platforms, code-execution runtimes for data pipelines.

What is the CVSS score for CVE-2026-68746?

CVE-2026-68746 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

notebook-based ML/AI development environmentscollaborative model experimentation platformscode-execution runtimes for data pipelines

MITRE ATLAS Techniques

AML.T0035 AI Artifact Collection

AML.T0047 AI-Enabled Product or Service

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.1

What are the technical details?

Original Advisory

Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the deployment group it belongs to, and resolves that identifier against a locally cached list of deployment groups on every request in order to decide whether Teams identity enforcement is active. Livebook.Hubs.TeamClient.handle_call/3 in lib/livebook/hubs/team_client.ex does not distinguish a deployment group that could not be resolved from one that was resolved with identity enforcement switched off: the clause matches only the case where a group was found with enforcement enabled, and falls through to a catch-all that reports enforcement as switched off for everything else. The two neighbouring functions that decide user and application access resolve the same identifier and treat the same unresolved result as a denial. When the identity status is reported as switched off, Livebook.ZTA.LivebookTeams.authenticate/3 in lib/livebook/zta/livebook_teams.ex returns empty identity metadata and allows the request to continue instead of halting it. LivebookWeb.UserPlug.build_current_user/3 merges that empty metadata into a newly built user, whose access type defaults to full access, and LivebookWeb.AuthPlug.authorized?/1 grants access to any user holding full access. The cached identifier becomes unresolvable when the deployment group it refers to is deleted while the agent is not connected to receive the change, most concretely when a deployment group is deleted during the window in which an agent is disconnected or reconnecting. The client removes the group from its cached list without clearing the identifier that refers to it. Any client able to reach the affected server over the network is then granted the same access as a fully privileged member of the organisation, including the ability to read notebooks and configured secrets, execute code on the server's runtime, and disrupt its operation. This issue affects livebook: from 0.19.7 before 0.19.9.

Exploitation Scenario

An attacker scans for internet- or network-reachable Livebook Agent or App Servers enforcing Teams identity. They either wait for or induce a network disruption that disconnects the target agent from Livebook Teams, then act during the window where an administrator (unaware of the attacker's presence) deletes or reorganizes deployment groups. When the agent reconnects or continues serving requests with its now-unresolvable cached deployment-group identifier, Livebook.Hubs.TeamClient.handle_call/3 falls through to its catch-all path and reports identity enforcement as switched off. The attacker then sends an ordinary unauthenticated request; LivebookWeb.UserPlug.build_current_user/3 builds a user defaulting to full access, and LivebookWeb.AuthPlug.authorized?/1 grants it — the attacker now reads notebooks and configured secrets and executes arbitrary code on the server's runtime as if they were a legitimate organization member.

Weaknesses (CWE)

CWE-636 Not Failing Securely ('Failing Open') CWE-636 Not Failing Securely ('Failing Open')

CWE-636 — Not Failing Securely ('Failing Open'): When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.