CVE-2026-68746

Name of the Vulnerable Software and Affected Versions livebook versions 0.19.7 through 0.19.8

Description A failing open issue in livebook allows an unauthenticated network client to gain full access to a server that enforces identity through Livebook Teams. This occurs when a Livebook Agent or App Server caches a deployment group identifier that becomes unresolvable, such as when the group is deleted while the agent is disconnected. The function handle call/3 in lib/livebook/hubs/team client.ex fails to distinguish between an unresolvable group and one where identity enforcement is disabled, leading the system to report enforcement as switched off. Consequently, the authenticate/3 function in lib/livebook/zta/livebook teams.ex returns empty identity metadata, which build current user/3 in LivebookWeb.UserPlug merges into a new user with default full access. This is then granted access by authorized?/1 in LivebookWeb.AuthPlug. An attacker can exploit this to read notebooks and secrets, execute code on the server's runtime, and disrupt operations.

Recommendations Update livebook to version 0.19.9 or later.