CVE-2026-68746: Livebook Authentication Bypass Vulnerability

CVE-2026-68746 Overview

CVE-2026-68746 is a fail-open authentication vulnerability in livebook-dev/livebook, an interactive notebook application for the Elixir programming language. The flaw affects Livebook Agent and App Server deployments that enforce identity through Livebook Teams. When a cached deployment group identifier becomes unresolvable, the server reports Teams identity enforcement as switched off and grants unauthenticated network clients full access. Affected versions range from 0.19.7 before 0.19.9. The vulnerability maps to [CWE-636: Not Failing Securely ('Failing Open')].

Critical Impact
An unauthenticated network attacker can obtain full-access user privileges on a Livebook server, enabling notebook reads, secret disclosure, arbitrary code execution on the runtime, and service disruption.

Affected Products

Livebook 0.19.7
Livebook 0.19.8
Livebook Agent and App Server deployments configured with Livebook Teams identity enforcement

Discovery Timeline

2026-08-05 - CVE-2026-68746 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-68746

Vulnerability Analysis

The vulnerability resides in the Zero Trust Authentication (ZTA) path for Livebook Teams. A Livebook Agent or App Server caches the identifier of the deployment group it belongs to and resolves that identifier against a locally cached list of deployment groups on every request. The resolution logic determines whether Teams identity enforcement is active.

In Livebook.Hubs.TeamClient.handle_call/3 within lib/livebook/hubs/team_client.ex, the pattern match only recognizes the case where a group is found with enforcement enabled. Every other outcome, including an unresolvable identifier, falls through to a catch-all clause that reports enforcement as switched off. Neighbouring functions handling user and application access treat the same unresolved result as a denial, creating an inconsistent security posture across the codebase.

When enforcement is reported as disabled, Livebook.ZTA.LivebookTeams.authenticate/3 in lib/livebook/zta/livebook_teams.ex returns empty identity metadata and continues the request. LivebookWeb.UserPlug.build_current_user/3 merges the empty metadata into a new user whose access type defaults to full access, and LivebookWeb.AuthPlug.authorized?/1 grants access to any user holding full access.

Root Cause

The root cause is a missing pattern match that fails to distinguish an unresolved deployment group from a resolved group with identity enforcement disabled. The client removes a deleted deployment group from its cached list without clearing the identifier that references it, leaving a dangling reference the code path interprets as "enforcement off."

Attack Vector

The cached identifier becomes unresolvable when the deployment group is deleted while the agent is disconnected or reconnecting to Livebook Teams. Once that window occurs, any client with network reach to the affected server is granted access equivalent to a fully privileged organisation member. The attacker can read notebooks and configured secrets, execute arbitrary code on the server's runtime, and disrupt operations.

text

       {:ok, %{teams_auth: true}} ->
         {:reply, :enabled, state}
 
-      _ ->
+      {:ok, %{teams_auth: false}} ->
+        # We only return disabled if we are certain, otherwise we might
+        # wrongly allow access.
         {:reply, :disabled, state}
+
+      _not_found ->
+        # We cannot find the deployment group, it may have been deleted,
+        # so we return :pending, similarly to the before-connected case.
+        {:reply, :pending, state}
     end
   end

Source: Livebook security patch commit 2d3a2c7. The patch adds an explicit clause for teams_auth: false and treats unresolved identifiers as :pending rather than :disabled, closing the fail-open path.

Detection Methods for CVE-2026-68746

Indicators of Compromise

Successful HTTP requests to Livebook endpoints from network clients without corresponding Livebook Teams identity metadata in access logs.
Livebook sessions where the effective user has full access despite no Teams-authenticated identity being recorded.
Deployment group deletion events in Livebook Teams that overlap with agent disconnect or reconnect windows.
Notebook execution, secret access, or runtime activity originating from unexpected source IP addresses on Livebook Agent or App Server hosts.

Detection Strategies

Audit Livebook access logs for authenticated sessions lacking Teams identity claims after any deployment group deletion.
Correlate Livebook Teams administrative events with agent connectivity telemetry to flag windows where an agent was offline during a group deletion.
Alert on any Livebook Agent or App Server running an affected version (0.19.7 or 0.19.8) that continues to serve requests after a Teams group change.

Monitoring Recommendations

Monitor for unexpected code execution or shell activity on hosts running Livebook runtimes.
Track outbound network connections from Livebook servers that could indicate secret exfiltration.
Log and review Livebook Teams deployment group lifecycle changes as security-relevant events.

How to Mitigate CVE-2026-68746

Immediate Actions Required

Upgrade all Livebook Agent and App Server instances to version 0.19.9 or later.
Inventory Livebook deployments to identify any running 0.19.7 or 0.19.8 with Teams identity enforcement enabled.
Rotate any secrets that were configured in affected Livebook instances during the vulnerability window.
Review notebook contents and runtime activity on affected servers for signs of unauthorized access.

Patch Information

The issue is resolved in Livebook 0.19.9. The fix adds an explicit clause distinguishing a deployment group resolved with identity enforcement disabled from one that could not be resolved at all. Unresolved identifiers now return :pending, matching the behaviour of the pre-connected state and refusing access rather than allowing it. See the GitHub Security Advisory GHSA-74j5-6grg-g6wj and the CNA advisory for CVE-2026-68746.

Workarounds

Restrict network access to Livebook Agent and App Server instances using firewall rules or a private network overlay until the patch is applied.
Avoid deleting Livebook Teams deployment groups while any associated agent is disconnected or reconnecting.
Place Livebook servers behind an authenticating reverse proxy that enforces identity independently of Livebook Teams.

bash

# Upgrade Livebook to the patched release
mix escript.install hex livebook 0.19.9

# Or, for container deployments, pin the patched image tag
docker pull ghcr.io/livebook-dev/livebook:0.19.9