CVE-2026-57510: SuperPlane Auth Bypass Vulnerability

CVE-2026-57510 Overview

CVE-2026-57510 is a broken object-level authorization (BOLA) vulnerability in SuperPlane versions before 0.27.0. The flaw resides in the CanvasService gRPC handlers, which fail to enforce organization scoping when processing canvas or queue UUIDs. Authenticated users holding viewer-level access to one organization can supply arbitrary UUIDs to read, write, or delete resources belonging to other tenants. The issue is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated low-privilege attackers can read cross-tenant execution history and secrets, inject queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.

Affected Products

SuperPlane versions prior to 0.27.0
Deployments exposing the CanvasService gRPC API to multi-tenant users
Any SuperPlane instance with viewer-level accounts across multiple organizations

Discovery Timeline

2026-07-28 - CVE-2026-57510 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-57510

Vulnerability Analysis

SuperPlane exposes a CanvasService over gRPC to manage automation canvases, queues, and execution events. The gRPC handlers accept canvas and queue UUIDs as user-controlled parameters but do not validate that the referenced object belongs to the caller's organization. As a result, any authenticated user with a valid session token can address objects owned by any tenant by supplying their UUIDs.

Because the missing check spans both read and mutation handlers, exploitation is not limited to information disclosure. Attackers can enumerate or reuse UUIDs to fetch execution history and event payloads that frequently contain secrets injected into automation pipelines. The same handlers allow writing new queue items and canvas events into another organization or deleting canvases outright.

Root Cause

The root cause is missing tenant scoping in the authorization layer of CanvasService. The service authenticates the caller and confirms they have viewer-level permissions on their own organization, then trusts the object identifier passed in the request. It never joins the target canvas or queue back to the caller's organization ID before executing the requested operation.

Attack Vector

An attacker registers or obtains any viewer-level account in a SuperPlane deployment. They then invoke CanvasService gRPC methods with canvas or queue UUIDs belonging to other tenants. UUIDs can be harvested from shared logs, prior employment, leaked responses, or brute-force of predictable identifiers. Successful calls return victim data or persist attacker-controlled state into victim organizations.

The upstream fix in commit 3e45cf4f1b5f1be9fbbfd90c97960a73f00f897b, shipped as part of SuperPlane v0.27.0, reworks CanvasService handling and removes affected pathways. See the VulnCheck Security Advisory and the GitHub Pull Request Discussion for the coordinated remediation.

Detection Methods for CVE-2026-57510

Indicators of Compromise

gRPC calls to CanvasService methods where the resolved canvas or queue organization ID does not match the caller's organization ID.
Unexpected DeleteCanvas or queue write operations originating from accounts that do not administer the affected canvas.
Access to execution history or event payloads by principals with no prior interaction with the target canvas.
Bursts of CanvasService requests from a single account iterating through UUIDs.

Detection Strategies

Correlate authenticated caller organization IDs with the organization ID of the target object in every CanvasService request log entry.
Alert on any viewer-role account performing write or delete operations on canvases or queues.
Baseline per-user access patterns against canvas ownership and flag deviations.

Monitoring Recommendations

Enable verbose gRPC audit logging on the SuperPlane API server, including caller identity, method name, and target UUIDs.
Forward SuperPlane audit logs to a centralized SIEM for cross-tenant correlation and long-term retention.
Monitor for secrets, tokens, or credentials appearing in outbound egress from execution history reads.

How to Mitigate CVE-2026-57510

Immediate Actions Required

Upgrade SuperPlane to version 0.27.0 or later on all self-hosted and managed deployments.
Rotate any secrets, API keys, or tokens that may have been exposed through canvas execution history or event payloads.
Review audit logs for cross-tenant CanvasService access and inform affected tenants of any confirmed exposure.
Restrict viewer-level account provisioning until the upgrade is verified across the environment.

Patch Information

The vulnerability is fixed in SuperPlane v0.27.0 via GitHub Commit 3e45cf4 and the associated pull request #5635. The patch enforces organization scoping in CanvasService handlers so that canvas and queue lookups are constrained to the caller's organization.

Workarounds

If upgrading is not immediately possible, restrict network access to the CanvasService gRPC endpoint to trusted service identities using mTLS or a service mesh policy.
Disable viewer-level self-service account creation until the patched version is deployed.
Place a reverse proxy in front of the gRPC API that rejects requests when the JWT organization claim does not match a per-request allowlist tied to the target resource.

bash

# Configuration example - upgrade SuperPlane to a fixed release
git fetch --tags
git checkout v0.27.0

# Verify the running version after redeploy
superplane version
# Expected: v0.27.0 or later