Vulnerability Description
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/determined-ai/determined
- https://github.com/determined-ai/determined/blob/main/master/internal/api_generi
- https://github.com/determined-ai/determined/issues/10270
- https://www.vulncheck.com/advisories/determined-missing-authorization-check-on-g
- https://github.com/determined-ai/determined/issues/10270
FAQ
What is CVE-2026-75109?
CVE-2026-75109 is a vulnerability with a CVSS score of 7.1 (HIGH). Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, o...
How severe is CVE-2026-75109?
CVE-2026-75109 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75109?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.