CVE-2026-68746: livebook from 0.19.7 (inclusive), before 0.19.9 (exclusive), 0.19.7 to before 0.19.9, 0.19.7 to before 0.19.9…

Affected technology

livebook · from 0.19.7 (inclusive), before 0.19.9 (exclusive)
livebook

livebook · 0.19.7 to before 0.19.9
livebook-dev

livebook · 0.19.7 to before 0.19.9, 0.19.7-cuda12 to before 0.19.9-cuda12
livebook-dev

livebook · fc2c87c6b0276705281842acbe17142d1ac4d555 to before *; status changes: d374e90647edbb00286bfee9182c0161d29a8e07 — unaffected, d6d0dfa746b172540442852f74de4a9deacc433b — unaffected, 2d3a2c710c880abd24a2bc888d3cf5239d98cf72 — unaffected
livebook-dev

Component: Elixir.Livebook.Hubs.TeamClient, Elixir.Livebook.ZTA.LivebookTeams, Elixir.LivebookWeb.AuthPlug
Function: 'Elixir.Livebook.Hubs.TeamClient':handle_call/3, 'Elixir.Livebook.Hubs.TeamClient':remove_deployment_group/2, 'Elixir.Livebook.Hubs.TeamClient':fetch_entry/3, 'Elixir.Livebook.ZTA.LivebookTeams':authenticate/3, 'Elixir.LivebookWeb.AuthPlug':authorized?/1
File: lib/livebook/hubs/team_client.ex, lib/livebook/zta/livebook_teams.ex, lib/livebook_web/plugs/auth_plug.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 7.7/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.