CVE-2023-28635: vantage6 - Defining resource name as integer may give unintended access
Summary
CVE-2023-28635: Defining resource name as integer may give unintended access in vantage6. Affects vantage6 versions < 4.0.0. Fixed in 4.0.0. How to fix ↓
Also tracked for
- vantage6-node · PyPI
The same CVE-2023-28635 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vantage6 is an open-source Python package available on PyPI. It is designed to facilitate collaborative data analysis and machine learning by allowing users to share and execute algorithms on distributed nodes. The package provides a framework for secure and privacy-preserving computation across multiple organizations. However, a vulnerability has been identified in vantage6 that allows malicious users to gain unintended access to resources by defining resource names as integers.
Vulnerability Detail
The vulnerability in vantage6 arises from the improper handling of resource names defined as integers. Malicious users can exploit this by creating resources with integer names to gain access to resources they are not authorized to see. For example, if a user is allowed to run tasks based on their user ID, an attacker can create a username with the same value as the user ID and gain unauthorized access to run algorithms. This vulnerability can lead to unauthorized access and potential misuse of resources. The recommended solution is to enforce that resource names always start with a character to prevent this mix-up of resource ID or name.
How To Fix
Latest published version: 5.0.3 as of 22 Oct 2026
pip install --upgrade "vantage6==5.0.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.0
This is the first release that contains the fix.
pip install --upgrade "vantage6==4.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been identified for this vulnerability. Users are encouraged to apply the patch once it becomes available.
Conclusion
The vulnerability in vantage6 that allows unintended access through the use of integer resource names can be mitigated by applying the upcoming patch in version 3.9. Users are advised to update to the latest version of the package to prevent potential unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vantage6 →
FAQ
The vulnerability allows malicious users to gain unintended access to resources they are not authorized to see. This can lead to unauthorized execution of algorithms and potential misuse of resources.
An attacker can create resources with integer names that match authorized user IDs, tricking the system into granting them access to run algorithms.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the patch once it is available to prevent potential misuse of resources.
While access controls can help prevent unauthorized access, this vulnerability bypasses those controls by exploiting the mix-up of resource ID or name. The recommended solution is to enforce that resource names always start with a character.
No alternative solution has been identified at this time. Users are advised to apply the patch once it is released.
References
Related vulnerabilities
Recent vulnerabilities recorded for vantage6.
