CVE-2026-119710 PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route

High 7.1 Published 30 Oct 2026 Updated 30 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119710?

CVE-2026-119710 is a high-severity vulnerability in pipeshub-ai, published on 30 Oct 2026.

Official description

PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings.

Weakness: CWE-862

Which versions are affected by CVE-2026-119710?

How do I fix CVE-2026-119710?

No fix has been published for CVE-2026-119710 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119710 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119710 exists.

Sources

Also known as GHSA-82c7-jq78-hwgw, GHSA-cwp5-6php-hrgx.