Insecure Direct Object Reference in Cube-studio

Cube-studio versions through 2026.09.01 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw located within its lifecycle management endpoints. Specifically, the affected files view_notebook.py, view_inferenceserving.py, and view_serving.py fail to properly authorize users before executing lifecycle commands on requested resource IDs. An authenticated attacker can exploit this by passing sequential integer identifiers to these endpoints, allowing them to stop, reset, clear, or redeploy notebooks and services belonging to other users. This vulnerability is critical for production environments, as successful exploitation enables an attacker to delete pods and take critical inference endpoints offline, resulting in a denial-of-service for legitimate services.

Impact

The vulnerability allows unauthorized control over arbitrary notebooks and services within a shared Cube-studio environment. An attacker with standard user access can cause widespread disruption by terminating production-critical inference endpoints and deleting Kubernetes pods. The scope of impact is limited to organizations hosting multi-user environments where notebook or service isolation relies on the integrity of the Cube-studio access control logic.

Recommendation

1. Upgrade Cube-studio to a version beyond 2026.09.01 once a patch is provided by the vendor.
2. Implement strict access control validation at the application layer for all lifecycle endpoints in view_notebook.py, view_inferenceserving.py, and view_serving.py.
3. Monitor web server logs for anomalous patterns of sequential ID requests to lifecycle management endpoints from authenticated user sessions.
4. Restrict access to the Cube-studio dashboard to trusted networks or implement mTLS to reduce the risk of unauthorized authenticated access.