vantage6 vulnerabilities

CVEs whose affected-version data names the vantage6 package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

18 CVEsRSS

CVE-2026-73652High

1mo ago

vantage6 is an open-source infrastructure for privacy preserving analysis

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorith…

vantage6 vulnerabilities

vantage6 is an open-source infrastructure for privacy preserving analysis

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

Vantage6: No limit on emails sent for password/MFA reset

Vantage6: 2FA can be circumvented with hacked email access

vantage6 node has an Improper Access Control issue

Vantage6: Set admin user and password from environment or configuration

vantage6 collaboration admins can extend their influence by expanding the collaboration

vantage6 vulnerable to a username timing attack on recover password/MFA token

vantage6's CORS settings overly permissive

vantage6 remote code execution vulnerability

vantage6 may create unencrypted tasks in encrypted collaboration

vantage6 has insecure SSH configuration for node and server containers

vantage6 does not properly delete linked resources when deleting a collaboration

Pickle serialization vulnerable to Deserialization of Untrusted Data

Defining resource name as integer may give unintended access in vantage6

vantage6 vulnerable to Improper Preservation of Permissions

vantage6 refresh tokens do not expire

vantage6 vulnerable to Observable Response Discrepancy