CVE-2026-68746 livebook-dev CVE debrief

Who should care

Livebook server administrators, users, and organizations that rely on Livebook Teams for identity enforcement should be aware of this vulnerability and take necessary actions to prevent unauthorized access. They should prioritize verifying their deployment group configurations and ensuring that all agents are properly connected and updated to prevent unauthorized access. Additionally, they should monitor Livebook server logs for unauthorized access attempts and implement compensating controls, such as network restrictions or additional authentication mechanisms, if necessary. This includes reviewing and updating Livebook deployment group configurations to ensure proper identity enforcement and verifying that all Livebook agents are connected and updated to receive changes to deployment groups. Livebook server administrators and users should also consider implementing additional security measures, such as restricting access to sensitive areas of the Livebook server or implementing two-factor authentication, to further reduce the risk of exploitation. Furthermore, they should ensure that all users and administrators are aware of the vulnerability and the necessary actions to take to prevent exploitation. This may involve providing additional training or guidance on how to verify deployment group configurations and ensure proper identity enforcement. By taking these steps, Livebook server administrators and users can help prevent unauthorized access and reduce the risk of exploitation of this vulnerability. Livebook server administrators and users should also review their incident response plans to ensure that they are prepared to respond to potential exploitation of this vulnerability. This includes identifying potential entry points, reviewing logs for suspicious activity, and having a plan in place to quickly respond to and contain potential security incidents. By being proactive and taking these steps, Livebook server administrators and users can help protect their systems and data from potential exploitation of this vulnerability. Livebook server administrators and users should also consider conducting regular security audits and vulnerability assessments to

Technical summary

The vulnerability occurs in livebook-dev livebook, where a Livebook Agent or App Server connected to Livebook Teams caches the identifier of the deployment group it belongs to. When the deployment group is deleted while the agent is not connected, the identifier becomes unresolvable, and the server reports identity enforcement as switched off, allowing full access to any network client. Livebook.Hubs.TeamClient.handle_call/3 in lib/livebook/hubs/team_client.ex does not distinguish a deployment group that could not be resolved from one that was resolved with identity enforcement switched off.

Defensive priority

Livebook server administrators and users should prioritize verifying their deployment group configurations and ensuring that all agents are properly connected and updated to prevent unauthorized access.

Recommended defensive actions

• Verify and update Livebook deployment group configurations to ensure proper identity enforcement.
• Ensure all Livebook agents are connected and updated to receive changes to deployment groups.
• Monitor Livebook server logs for unauthorized access attempts.
• Implement compensating controls, such as network restrictions or additional authentication mechanisms.
• Review and update incident response plans to ensure preparedness for potential exploitation.
• Conduct regular security audits and vulnerability assessments to identify potential vulnerabilities.
• Verify that all users and administrators are aware of the vulnerability and the necessary actions to take to prevent exploitation.

Evidence notes

The vulnerability allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams when the identity status is reported as switched off due to a deleted deployment group. Evidence is based on official CVE and NVD records, as well as source references from Erlef and GitHub.

Official resources