CVE-2026-57510

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/superplanehq/superplane/commit/3e45cf4f1b5f1be9fbbfd90c97960a73f00f897b
https://github.com/superplanehq/superplane/pull/5635
https://github.com/superplanehq/superplane/releases/tag/v0.27.0
https://www.vulncheck.com/advisories/superplane-broken-object-level-authorization-via-canvasservice-grpc

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) SuperPlane anterior a 0.27.0 contiene una vulnerabilidad de autorización a nivel de objeto defectuosa en los manejadores gRPC de CanvasService que permite a usuarios autenticados con acceso de nivel de visor a una organización acceder a recursos pertenecientes a otras organizaciones al proporcionar UUIDs de lienzo o cola arbitrarios sin alcance de organización. Los atacantes pueden leer el historial de ejecución entre inquilinos y las cargas útiles de eventos que contienen secretos sensibles, escribir elementos de cola y eventos de lienzo en organizaciones víctimas, eliminar lienzos arbitrarios y perturbar los flujos de trabajo de automatización a través de los límites de los inquilinos.

Information

Published : 2026-07-28 20:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-57510

Mitre link : CVE-2026-57510

CVE.ORG link : CVE-2026-57510

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-57510", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57510", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-28T19:48:25.839765Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/superplanehq/superplane", "vendor": "superplanehq", "product": "superplane", "versions": [{"status": "affected", "version": "0", "lessThan": "0.27.0", "versionType": "semver"}], "packageURL": "pkg:github/superplanehq/superplane", "defaultStatus": "affected"}]}], "published": "2026-07-28T20:17:27.027", "references": [{"url": "https://github.com/superplanehq/superplane/commit/3e45cf4f1b5f1be9fbbfd90c97960a73f00f897b", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/superplanehq/superplane/pull/5635", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/superplanehq/superplane/releases/tag/v0.27.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/superplane-broken-object-level-authorization-via-canvasservice-grpc", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries."}, {"lang": "es", "value": "SuperPlane anterior a 0.27.0 contiene una vulnerabilidad de autorizaci\u00f3n a nivel de objeto defectuosa en los manejadores gRPC de CanvasService que permite a usuarios autenticados con acceso de nivel de visor a una organizaci\u00f3n acceder a recursos pertenecientes a otras organizaciones al proporcionar UUIDs de lienzo o cola arbitrarios sin alcance de organizaci\u00f3n. Los atacantes pueden leer el historial de ejecuci\u00f3n entre inquilinos y las cargas \u00fatiles de eventos que contienen secretos sensibles, escribir elementos de cola y eventos de lienzo en organizaciones v\u00edctimas, eliminar lienzos arbitrarios y perturbar los flujos de trabajo de automatizaci\u00f3n a trav\u00e9s de los l\u00edmites de los inquilinos."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}