Deleting a collaboration should also delete linked resources
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect that affects versions prior to 4.0.0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases. Version 4.0.0 contains a patch for this issue. There are no known workarounds.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vantage6 | vantage6 | before 4.0.0 | 4.0.0 | Patch available | CNA |
| — | vantage6 (PyPI) | before 4.0.0 | 4.0.0 | Patch available | GHSA-rf54-7qrr-96j6 |
- vantage6 Vendorvantage6 Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA
- vantage6 (PyPI) Vendor— Affected before 4.0.0 Fixed in 4.0.0 Patch available GHSA-rf54-7qrr-96j6
Remediation
- Fix · CNA vantage6 (vantage6) Fixed in 4.0.0
- Fix · GHSA-rf54-7qrr-96j6 vantage6 (PyPI) Fixed in 4.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-41881
- 2026-10-03 Alias added: GHSA-rf54-7qrr-96j6
References
Advisory 2
Other 4
- https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400
- https://github.com/vantage6/vantage6/commit/cce9538f8b70e814c080dd0ae43b297f3af8a732
- https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-200.yaml
- https://github.com/vantage6/vantage6
More Vantage6 vulnerabilities
- TI-2024-14786 vantage6 unencrypted task can be created in encrypted collaboration CVSS 3.1MEDIUM 4.3
- TI-2024-14378 vantage6 insecure SSH configuration for node and server containers CVSS 3.1CRITICAL 9.8
- TI-2024-14374 Remote code execution in vantage6 CVSS 3.1HIGH 8.8
- TI-2023-09727 Refresh tokens do not expire in Vantage6 CVSS 3.1HIGH 8.8
- TI-2023-25773 vantage6 Node accepts non-whitelisted algorithms from malicious server CVSS 3.1HIGH 8.8
- TI-2023-09728 vantage6's Pickle serialization is insecure CVSS 3.1HIGH 7.2
Sources
- CVE-2023-41881 · CVE Program
- CVE-2023-41881 · NVD
- FIRST EPSS
- GHSA-rf54-7qrr-96j6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences