CVE-2026-111672: Authorization Bypass Through User-Controlled Key in data-infra cube-studio

CVE-2026-111672 describes a missing authorization check in cube-studio's myapp/views/view_pipeline.py, affecting versions up to and including 2026.09.01. Authenticated users can bypass authorization controls by using user-controlled keys (pipeline IDs) to access or copy pipelines from other project groups. The vulnerability enables enumeration of sequential pipeline IDs through various endpoints (web, log, monitoring, pod, copy_pipeline), exposing internal workflow metadata and allowing cloning of pipelines.

The vulnerability allows authenticated users to access and copy pipelines from other project groups without proper authorization. This exposure includes sensitive information such as DAGs, cluster names, namespaces, Argo workflow IDs, and pod names. While it does not allow privilege escalation or remote code execution, it compromises confidentiality and integrity of pipeline data within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to only necessary scopes and monitor access to pipeline-related endpoints to detect unauthorized enumeration or copying attempts.