The vulnerability stems from improper handling of deployment group identifiers cached by Livebook Agents or App Servers connected to Livebook Teams. When a deployment group is deleted while the agent is disconnected, the cached identifier remains but cannot be resolved against the locally cached list of deployment groups. The function Livebook.Hubs.TeamClient.handle_call/3 does not differentiate between an unresolved identifier and one resolved with enforcement off, defaulting to treating enforcement as off. Consequently, Livebook.ZTA.LivebookTeams.authenticate/3 returns empty identity metadata, which is merged into a user profile granting full access. This allows any unauthenticated network client to access the server with full privileges, including reading notebooks, secrets, executing code, and disrupting operations. The issue affects livebook versions from 0.19.7 before 0.19.9.

An unauthenticated attacker who can reach the affected Livebook server over the network can gain full privileged access. This includes reading sensitive notebooks and secrets, executing arbitrary code on the server runtime, and potentially disrupting server operations. The vulnerability effectively bypasses identity enforcement mechanisms provided by Livebook Teams under specific conditions involving deployment group deletion and agent reconnection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or patch information provided at this time. Until a patch is available, administrators should monitor deployment group configurations and agent connectivity to minimize the window in which cached identifiers become stale. Avoid deleting deployment groups while agents are disconnected if possible.