CVE-2026-119710highCWE-862

CVE-2026-119710: falha de alta gravidade em pipeshub-ai

PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route

Publicada em

Seguir esta CVE+ Monitorar pipeshub-ai

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.4%
PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Produtos afetados
pipeshub-ai · pipeshub-ai
CVEs relacionadas — pipeshub-ai

No mesmo produto, das mais perigosas para as menos.

CVE-2025-67506CRITICALPipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File UploadEPSS 1.8%CVE-2026-119712MEDIUMPipesHub before 0.10.0 SSRF via Image URLs in Indexed DocumentsEPSS 0.3%CVE-2026-119711MEDIUMPipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For HeaderEPSS 0.2%