Database/Control plane, storage & DevOps
Determined AI (master API, generic task kill/pause/unpause handlers): The generic task kill, pause and unpause
Impact
The generic task kill, pause and unpause endpoints run no ownership check, so any authenticated user terminates or suspends another user's tasks. On a shared GPU cluster that means one tenant can wipe out days of another team's training run and free their GPUs, with no permission escalation required.
Who can reach it
Any authenticated Determined user with network access to the master API. Affects versions up to and including 0.38.1.
What to do
Upgrade Determined past 0.38.1 and restart the master. Until then, check master audit logs for kill/pause calls whose caller does not match the task owner - the behaviour is indistinguishable from a legitimate request in the task's own history.
References
Related entries
- Jenkins ThinBackup plugin: attacker redirects backups and pulls arbitrary controller files into themCVE-2026-84667 · Jenkins ThinBackup plugin (backup configuration writable via Stapler data binding)High
- Linux kernel nfsd: stale opcnt after compound release leaks adjacent slab memory through the RPC status netlink dumpCVE-2026-89691 · Linux kernel nfsd (nfsd4_release_compoundargs, RPC status netlink interface)High
- Linux kernel nfsd: dispatch error paths leave the status seqlock counter odd, exposing mutating compound stateCVE-2026-89705 · Linux kernel nfsd (nfsd_dispatch rq_status_counter seqlock protocol)High
- Harness: missing space-scoped access control lets any authenticated user read other spaces' infra provider configsCVE-2026-92750 · Harness (infrastructure provider read endpoint, /api/v1/infraproviders)High
- MinIO: unsigned x-amz-copy-source on a presigned PUT URL turns one-object write into a read of any objectCVE-2026-97731 · MinIO (SigV4 signed-header validation, extractSignedHeaders)High
- Flux CD (allow-webhooks NetworkPolicy, notification-controller event server): CROSS-TENANT EVENT FORGERY: theNCVD-2026-057-flux-cd-allow-webhooks-networkpo · Flux CD (allow-webhooks NetworkPolicy, notification-controller event server)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.