Skip to content
Multiple Vulnerabilities Discovered in PipesHub AI Platform

Multiple Vulnerabilities Discovered in PipesHub AI Platform

First seen 31 Oct 2026, 06:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 31, 2026 at 08:42 UTC
  • •CVE-2026-119712 allows SSRF attacks via image URLs.
  • •CVE-2026-119710 enables deletion of connectors by low-privileged users.
  • •Proof-of-concept exploits are publicly available for both vulnerabilities.

PipesHub has disclosed multiple vulnerabilities, including CVE-2026-119712, a server-side request forgery (SSRF) flaw, and CVE-2026-119710, an event type injection vulnerability. CVE-2026-119712 allows attackers to exploit image URLs in indexed documents to access internal services, while CVE-2026-119710 enables authenticated users to delete connectors without proper permissions. These vulnerabilities affect versions prior to 0.10.0 of PipesHub. Proof-of-concept exploits are available for both vulnerabilities, raising concerns about potential exploitation. Users with crawl-write permissions are particularly at risk, as they can trigger deletions that disrupt data workflows. The vulnerabilities were published on October 30, 2026, and users are advised to upgrade to the fixed release immediately.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-30
CVE-2026-119712 published
PipesHub disclosed an SSRF vulnerability allowing internal service access via image URLs.
Sploitus
2026-10-30
CVE-2026-119710 published
PipesHub revealed an event type injection vulnerability allowing connector deletion by low-privileged users.
Redpacketsecurity
2026-10-30
CVE-2026-119711 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (6)

Following this threat?

Track CVE-2026-119710 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

Which versions of PipesHub are affected?
PipesHub versions prior to 0.10.0 are affected by these vulnerabilities.
Is there a patch available?
Yes, users are advised to upgrade to the fixed release to mitigate these vulnerabilities.
What should I do if I can't upgrade immediately?
Restrict access to the affected routes and review user permissions until a patch can be applied.