CVE-2026-75109

This vulnerability in Determined AI represents a shared-code-path authorization failure: authenticated users can terminate, pause, or unpause any task in the system, not just their own. The gap exists because generic task utility handlers were likely written as internal tooling before multi-tenancy was hardened, while specific resource handlers received proper authorization checks during later development. Developers who touched specific handlers added checks; shared utility functions accumulated authorization debt because each developer assumed someone else was handling it. This is a predictable, documented vulnerability class that recurs across ML platforms, Kubernetes, and cloud resource managers. The CVSS 7.1 with EPSS 0.00243 will mislead defenders. EPSS measures deployment telemetry from known exploitation — it says nothing about source-code reconnaissance. An attacker reading the open-source repository finds these endpoints immediately. The obscurity is in the code, not in the deployment. Low EPSS combined with medium-high severity makes this a deprioritization target, which is exactly what keeps it viable. In ML compute environments, the blast radius is worse than the CVE suggests. Pause is not equivalent to kill — paused jobs consume cluster reservations while the attacker runs competing workloads on hijacked GPU resources. This is resource theft hiding in plain sight. More damaging: unpause introduces an integrity violation masquerading as an availability attack. Gradient descent is path-dependent; pausing at epoch boundary N and unpausing at boundary M corrupts model convergence silently. The model trains to completion with subtle weight corruption that no logs will reveal. Investigate your exposure: check git history for generic task handlers authored by different developers than resource-specific handlers, look for commits with 'admin' or 'internal' in message that weren't reviewed against the multi-tenancy feature branch, and determine whether pause involves checkpointing to user-controlled paths. The fix is trivial — add an authorization check to the shared function — but deployment is hard. You cannot patch mid-training without killing weeks of GPU-hours, which means the unpatched window in active ML environments is measured in training cycles, not days.

Reviewed through automated stages and approved by a human before publication.