CVE-2026-69119: Taubyte Tau Authorization Bypass Flaw

CVE-2026-69119 Overview

CVE-2026-69119 is a missing authorization vulnerability in Taubyte Tau v1.1.10 affecting the services/auth HTTP service. Any authenticated user holding a valid GitHub OAuth token can read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/{id} endpoints. The GitHubTokenHTTPAuth middleware validates only that the caller presents a valid GitHub token without verifying ownership or access rights to the target project. This enables cross-tenant project takeover through bare key-value store operations such as projects.Fetch and project.Delete. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
An attacker with any valid GitHub OAuth token can enumerate, exfiltrate, or permanently destroy projects belonging to other tenants of the same Taubyte deployment.

Affected Products

Taubyte Tau v1.1.10
services/auth HTTP service component
Deployments exposing the /projects/{id} endpoints to authenticated GitHub users

Discovery Timeline

2026-08-11 - CVE-2026-69119 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-69119

Vulnerability Analysis

The vulnerability lives in Taubyte Tau's authentication service, which fronts project management operations over HTTP. The GitHubTokenHTTPAuth middleware performs identity verification but omits any authorization check tying the caller to the requested project. Once the middleware admits the request, handlers dispatch key-value store operations directly against the project ID supplied in the URL path.

Because project IDs are the sole selector for the backing datastore, an attacker who guesses or enumerates an ID can execute projects.Fetch to read project metadata or project.Delete to remove it permanently. The impact spans confidentiality of stored project data and integrity and availability of the tenant workload. Multi-tenant deployments are affected because the middleware does not scope tokens to their originating tenant.

Root Cause

The root cause is authorization missing from the request path between the authentication middleware and the datastore operations. Access decisions are made at the token layer only, without enforcing a relationship between the authenticated GitHub identity and the target project's owner or repository.

Attack Vector

Exploitation requires a valid GitHub OAuth token and network access to the Tau HTTP API. The attacker issues GET /projects/{id} to read a victim project or DELETE /projects/{id} to destroy it, substituting an arbitrary or enumerated project ID. No user interaction on the victim side is required.

// Security patch in services/auth/github_http_endpoints.go
// fix(auth): bind project and repository routes to the caller's repo access (#514)
func (srv *AuthService) getGitHubUserRepositoryHTTPHandler(ctx http.Context) (interface{}, error) {
	ctxVars := ctx.Variables()
	client, err := getGithubClientFromContext(ctx)
	if err != nil {
		return nil, err
	}
	provider, err := maps.String(ctxVars, "provider")
	if err != nil {
		return nil, err

Source: GitHub Commit f5c9c9c

The patch retrieves an authenticated GitHub client from the request context and uses it to validate that the caller actually has access to the referenced repository before performing project operations.

Detection Methods for CVE-2026-69119

Indicators of Compromise

Unexpected DELETE /projects/{id} requests targeting project IDs that do not belong to the authenticated GitHub user
GET /projects/{id} requests where the response returns metadata for a project the caller does not own
Sudden disappearance of project records from the KV store without a corresponding administrative action
Repeated /projects/{id} requests iterating through sequential or high-entropy ID values from a single token

Detection Strategies

Correlate the GitHub OAuth token identity with the owner field of accessed projects and alert on mismatches
Baseline typical per-tenant request patterns to /projects/{id} and flag cross-tenant access attempts
Deploy Web Application Firewall rules that log the full request path, method, and authenticated principal for every /projects/{id} call

Monitoring Recommendations

Ingest Tau services/auth HTTP access logs into a centralized analytics platform for retention and correlation
Monitor project deletion events and require a secondary review workflow for high-value tenants
Track failed and successful authorization decisions after applying the patch to detect probing behavior

How to Mitigate CVE-2026-69119

Immediate Actions Required

Upgrade Taubyte Tau beyond v1.1.10 to a release containing commit f5c9c9c311a1ff156814e0c81f186bfd101ec237
Restrict network exposure of the services/auth HTTP endpoints to trusted networks until the patch is applied
Rotate or revoke GitHub OAuth tokens issued to users who no longer require Tau access
Audit project records for unauthorized reads or deletions since the vulnerable version was deployed

Patch Information

The vendor addressed the issue in commit f5c9c9c311a1ff156814e0c81f186bfd101ec237, titled fix(auth): bind project and repository routes to the caller's repo access (#514). The fix injects a GitHub client derived from the caller's token and verifies repository access before permitting project operations. Additional context is available in the GitHub Issue #513 and the VulnCheck Security Advisory.

Workarounds

Place the Tau API behind a reverse proxy that enforces per-tenant authorization by inspecting the requested project ID against the caller's identity
Disable the GET and DELETE /projects/{id} routes for untrusted user populations until patching is complete
Take offline backups of project data so that unauthorized project.Delete calls can be reversed

bash

# Example reverse-proxy rule enforcing method restriction until patched
location ~ ^/projects/[^/]+$ {
    limit_except GET {
        deny all;
    }
    proxy_pass http://tau_auth_upstream;
}