CVE-2026-73652: vantage6 Package Allows Unauthorized Editing of Algorithms Under Review
Summary
CVE-2026-73652: vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review. Affects vantage6 versions < 5.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vantage6 package is a collaborative platform designed for algorithm development and execution in a secure environment. It enables developers to create, share, and manage algorithms efficiently. However, it has been identified that the package lacks proper ownership checks, leading to potential security risks when multiple developers are involved in the review process.
Vulnerability Detail
The vulnerability arises from an inadequate edit permission system that does not verify the ownership of algorithms. This flaw allows one developer to modify another developer's algorithm that is pending or under review. The most significant risk is that a malicious developer could change the algorithm's metadata, including the image or image tag, leading to the approval of a different image than intended. This could compromise the integrity of the algorithms being executed by nodes in the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. It is recommended to limit access to the algorithm editing features to trusted developers until a patch is released.
Conclusion
The vulnerability CVE-2026-73652 in the vantage6 package poses a significant risk by allowing unauthorized edits to algorithms under review. Users are encouraged to monitor for patches and limit access to sensitive features until a resolution is provided.
See every vulnerability recorded for vantage6 →
FAQ
CVE-2026-73652 is a vulnerability in the vantage6 package that allows one developer to edit another developer's algorithm that is pending or under review.
The main risk is that a malicious developer could alter algorithm metadata, potentially leading to the execution of unauthorized or harmful algorithms.
As of now, there are no patches available to fix this vulnerability. Users should monitor the package for future updates.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 7.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for vantage6.
