data-infra CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH data-infra CVE published 2026-10-16

CVE-2026-111671

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. This could lead to unauthorized access and disruption of services. The vulnerability exists in the view_notebook.py, view_inferenceserving.py, and view_serving.py files. Attackers can pass sequential ids to li [truncated]