SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.
CVE-2026-57510
HIGHPre-NVD 8.88.8—Trending — 3 sources updated this week
EchelonGraph scoreHIGH confidence
Score 8.8 from GitHub Security Advisory (severity: HIGH) published 2026-07-28. a secondary CVSS source baseline 8.8; sources differ by 0.0.
Triggered by: GitHub Security Advisory CVSS
Sources: ghsa, secondary
8.8EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
- High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: —CVSS: 8.8Exploit: None knownExposed: 0
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 8.8
- EG Score
- 8.8(high)
- EG Risk
- 44(Track)EG Risk 44/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity88% × 45%Exploitation0% × 40%Automatability30% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- Not listed
Published
July 28, 2026
Last Modified
July 28, 2026
Advisory Details (4)
Auto-updated Jul 28, 2026Patch available. Sources: github_release, github_pr, github_commit.
generic
SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC | Advisories | VulnCheck
https://www.vulncheck.com/advisories/superplane-broken-object-level-authorization-via-canvasservice-grpcgithub_commit
commit 3e45cf4f1b5f (superplanehq/superplane)
Fix landed in superplanehq/superplane commit 3e45cf4f1b5f — awaiting tagged release
https://github.com/superplanehq/superplane/commit/3e45cf4f1b5f1be9fbbfd90c97960a73f00f897bgithub_pr
fix: remove core sendEmail notifications
Fix merged in superplanehq/superplane PR #5635 on 2026-06-22 — awaiting tagged release
https://github.com/superplanehq/superplane/pull/5635github_release Patch Available
v0.27.0
Patch available: superplanehq/superplane v0.27.0
https://github.com/superplanehq/superplane/releases/tag/v0.27.0Vendor Advisories for CVE-2026-57510(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 5× in last 7d / 5× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-07-29 08:01 UTCEG score recompute
- 2026-07-29 08:01 UTCGHSA enrichment
- 2026-07-28 20:26 UTCEG score recompute
- 2026-07-28 19:28 UTCEG score recompute
- 2026-07-28 19:27 UTCMITRE cvelistV5first tracked
Related CVEs(same CWE)
Same CWE
10 shownCWE-639
- CVE-2018-25270EG 9.8CRITICAL
- CVE-2017-20223EG 9.8CRITICAL
- CVE-2019-25487EG 9.8EPSS p94CRITICAL
- CVE-2019-25235EG 9.8CRITICAL
- CVE-2019-15310EG 9.8EPSS p94CRITICAL
- CVE-2019-15913EG 9.8CRITICAL
- CVE-2019-16340EG 9.8EPSS p97CRITICAL
- CVE-2019-13360EG 9.8EPSS p98CRITICAL
- CVE-2019-12866EG 9.8CRITICAL
- CVE-2019-9756EG 9.8CRITICAL
Frequently asked(4)
What is CVE-2026-57510?
CVE-2026-57510 is a high vulnerability published on July 28, 2026. SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs…
When was CVE-2026-57510 disclosed?
CVE-2026-57510 was first published in the National Vulnerability Database on July 28, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
What is the CVSS score of CVE-2026-57510?
CVE-2026-57510 has a CVSS v3 base score of 8.8 (NVD).
How do I remediate CVE-2026-57510?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-57510, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2026-57510
Is Your Infrastructure Affected by CVE-2026-57510?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.