Event Type Injection Vulnerability in PipesHub by PipesHub AI

CVE-2026-119710

What is CVE-2026-119710?

PipesHub versions prior to 0.10.0 are susceptible to an event type injection vulnerability. This security flaw permits authenticated users with the crawl:write scope to execute unauthorized deletion of connectors. By injecting malicious values into the :connector path segment, attackers can bypass established connector:delete and lock checks, enabling them to delete connector instances and erase record embeddings through manipulating the schedule route. It is crucial for users to update to version 0.10.0 or later to mitigate this vulnerability. More information can be found in the GitHub Security Advisory and the VulnCheck Advisory.

References