CVE-2026-119710 in PipesHub
Summary
by MITRE • 10/30/2026
PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
PipesHub versions prior to 0.10.0 contain a critical event type injection vulnerability that fundamentally undermines the application's access control mechanisms. This flaw allows authenticated users who possess only the crawl:write scope, which is intended for limited write operations related to data ingestion and crawling activities, to execute administrative-level actions such as deleting connectors entirely. The root cause of this issue lies in how the application parses route parameters within its scheduling system. Specifically, when a user interacts with the schedule route by providing a :connector path segment, the backend fails to strictly validate or sanitize this input against expected connector identifiers. Instead of treating the value solely as an identifier for lookup purposes, the system interprets specific string patterns embedded in that parameter as executable event types or command triggers.
The technical exploitation involves sending a crafted request where the :connector parameter is set to web.delete rather than a valid connector ID. By injecting this malicious payload into the path segment, the attacker effectively tricks the application's routing and execution logic into treating the input not as data but as an instruction to perform a deletion operation on the backend system. This bypasses standard authorization checks that would normally require explicit permissions for connector management or destruction. The vulnerability exploits a lack of strict type checking and command separation in the API handler, allowing arbitrary code execution paths to be triggered through parameter manipulation rather than legitimate functional usage.
The operational impact of this vulnerability is severe, as it enables an attacker with minimal privileges to disrupt service availability and compromise data integrity. By successfully deleting connectors, the attacker can remove critical integration points that facilitate data flow between PipesHub and external systems. Furthermore, the deletion process triggers a cascade effect where associated record embeddings are purged from storage. This results in significant data loss for affected organizations, as historical records linked to those connectors become inaccessible or permanently erased. The ability to bypass lock checks further exacerbates the risk, allowing deletions even on resources that might otherwise be protected by operational locks intended to prevent concurrent modifications during active processes.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code Command Injection and CWE-285 Improper Authorization. The attack vector is consistent with MITRE ATT&CK technique T1078 Valid Accounts, as it relies on legitimate credentials but abuses their assigned permissions through parameter manipulation rather than privilege escalation in the traditional sense. It also reflects aspects of T1499 Endpoint Denial of Service due to the potential for service disruption caused by connector removal and data purging.
Mitigation strategies must prioritize immediate patching to version 0.10.0 or later, where this parsing logic has been corrected to enforce strict validation on path segments. In environments where upgrading is not immediately feasible, network-level controls such as Web Application Firewalls should be configured to detect and block requests containing suspicious patterns in URL parameters that resemble command strings rather than alphanumeric identifiers. Additionally, implementing principle of least privilege strictly at the API gateway level can help limit the blast radius if similar vulnerabilities exist elsewhere by ensuring that even if an injection occurs, downstream services do not have broad administrative access without additional verification steps such as multi-factor authentication for destructive operations.