CVE-2026-57510

Name of the Vulnerable Software and Affected Versions SuperPlane versions prior to 0.27.0

Description An issue exists in the CanvasService gRPC handlers where broken object-level authorization allows authenticated users with viewer-level access in one organization to access resources of other organizations. This occurs when arbitrary canvas or queue UUIDs are supplied without organization scoping. This flaw enables attackers to read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.

Recommendations Update SuperPlane to version 0.27.0 or later.