Answer in brief
CVE-2026-119710 records a High severity (CVSS 7.1) vulnerability in PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route. The current sources do not mark it as known exploited. The current feed maps pipeshub-ai/pipeshub-ai (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps pipeshub-ai/pipeshub-ai (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| pipeshub-ai/pipeshub-aigeneric | >=0.3.0 <0.10.0 | 0.10.0 |
Published upstream
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 30, 2026
PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings.
Quoted source text, attributed separately from HOL analysis.