CVE-2026-73652: vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-13 · updated 2026-09-18
Weakness: CWE-863

Description

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted for approval. No fixed version is available as of this review.

Affected products

vantage6: through 5.0.2

References

https://github.com/vantage6/vantage6/security/advisories/GHSA-47w6-gwp4-w6vc

Get alerted when CVE-2026-73652 or the next vulnerability affects your stack