SZB-ae37670124
EUVD lists connector deletion flaw in PipesHub before 0.10.0 (EUVD-2026-114115)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- PipesHub
- Product
- PipesHub
- First seen
Summary
The EUVD listing says authenticated users with only the crawl:write scope can delete connectors by injecting into the connector path segment. It gives a CVSS v3.1 score of 7.1/10 and was last updated 2026-10-30.
If you use PipesHub
Upgrade PipesHub to version 0.10.0 or later
Audit crawl:write scope assignments and remove unneeded grants
Check for unexpected connector deletions
What the sources say 1
· Mastodon: “PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment.” Source