---
id: CVE-2026-75109
title: >-
  Determined fails to authorize requests on the generic task kill, pause, and
  unpause endpoints in the API handlers
summary: >-
  Determined fails to authorize requests on the generic task kill, pause, and
  unpause endpoints in the API handlers. Authenticated attackers can disrupt
  other users' workloads by terminating, pausing, or unpausing tasks they do not
  own.
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'
cwe:
  - CWE-862
vendor: determined-ai
product: determined
affected:
  - determined <= 0.38.1
published: '2026-08-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75109'
references:
  - url: 'https://github.com/determined-ai/determined'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/determined-ai/determined/blob/main/master/internal/api_generic_tasks.go
    label: disclosure@vulncheck.com
  - url: 'https://github.com/determined-ai/determined/issues/10270'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/determined-missing-authorization-check-on-generic-task-endpoints
    label: disclosure@vulncheck.com
  - url: 'https://github.com/determined-ai/determined/issues/10270'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00436
epssPercentile: 0.35211
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-18T15:34:17.370582Z'
ingestedAt: '2026-09-24T15:45:56.703Z'
---

## Overview

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.