CVE-2026-75109

EUVD-2026-60388
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/determined-ai/determined
https://github.com/determined-ai/determined/blob/main/master/internal/api_generic_tasks.go
https://github.com/determined-ai/determined/issues/10270
https://www.vulncheck.com/advisories/determined-missing-authorization-check-on-generic-task-endpoints