CVE-2026-119710

Name of the Vulnerable Software and Affected Versions PipesHub versions 0.3.0 through 0.9.9

Description An event type injection issue allows authenticated users with the crawl:write scope to delete connectors. By injecting a value such as web.delete into the :connector path segment of the schedule route, an attacker can bypass connector:delete and lock checks. This action results in the removal of connector instances and the purging of record embeddings.

Recommendations Update PipesHub to version 0.10.0 or later. Restrict the use of the :connector parameter in the schedule route to prevent unauthorized deletions.