CVE-2026-57510 in SuperPlane
Summary
by MITRE • 07/28/2026
SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability exists within the SuperPlane platform prior to version 0270 and represents a critical broken object-level authorization flaw in the CanvasService gRPC handlers. The weakness allows authenticated users with viewer-level permissions in one organization to bypass proper access controls and gain unauthorized access to resources belonging to other organizations through manipulation of canvas or queue UUIDs. This type of vulnerability falls under CWE-285 which specifically addresses improper authorization issues within software systems. The flaw demonstrates a fundamental failure in implementing proper tenant scoping mechanisms for resource access control.
The technical implementation of this vulnerability stems from the absence of organization-level validation when processing gRPC requests through CanvasService handlers. When users submit requests containing canvas or queue UUIDs, the system fails to verify that these identifiers belong to the requesting user's organization before granting access. This oversight creates a cross-tenant data exposure scenario where legitimate authentication credentials can be leveraged to traverse organizational boundaries. The vulnerability operates at the service layer rather than the application layer, making it particularly dangerous as it bypasses traditional application-level access controls and directly targets the underlying gRPC communication protocols.
The operational impact of this vulnerability extends far beyond simple information disclosure. Attackers can read execution history and event payloads that may contain sensitive secrets, credentials, or confidential business data from other organizations. The ability to write queue items and canvas events into victim organizations enables active manipulation of automation workflows, potentially leading to system disruption or malicious activity injection. Furthermore, the capability to delete arbitrary canvases creates destructive potential that can halt critical automation processes and cause significant operational damage. This vulnerability directly maps to multiple techniques described in the MITRE ATT&CK framework under privilege escalation and defense evasion tactics.
Organizations utilizing SuperPlane versions prior to 0270 face substantial risk from this authorization flaw, particularly those managing multiple client organizations or sensitive data environments. The vulnerability essentially eliminates the concept of tenant isolation within the platform, making it impossible to maintain proper data segregation between different organizational units. Security teams should immediately implement monitoring for unauthorized access patterns and consider implementing additional access controls at the network level while awaiting the official patch release. The remediation process requires comprehensive validation of all gRPC handlers to ensure proper organization scoping and implementation of mandatory access control checks before resource operations can proceed.