CVE-2026-68746

Weakness

Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the deployment group it belongs to, and resolves that identifier against a locally cached list of deployment groups on every request in order to decide whether Teams identity enforcement is active. Livebook.Hubs.TeamClient.handle_call/3 in lib/livebook/hubs/team_client.ex does not distinguish a deployment group that could not be resolved from one that was resolved with identity enforcement switched off: the clause matches only the case where a group was found with enforcement enabled, and falls through to a catch-all that reports enforcement as switched off for everything else. The two neighbouring functions that decide user and application access resolve the same identifier and treat the same unresolved result as a denial. When the identity status is reported as switched off, Livebook.ZTA.LivebookTeams.authenticate/3 in lib/livebook/zta/livebook_teams.ex returns empty identity metadata and allo

Affected products

• livebook livebook

References

• https://cna.erlef.org/cves/CVE-2026-68746.html
• https://github.com/livebook-dev/livebook/commit/2d3a2c710c880abd24a2bc888d3cf5239d98cf72
• https://github.com/livebook-dev/livebook/commit/d374e90647edbb00286bfee9182c0161d29a8e07
• https://github.com/livebook-dev/livebook/commit/d6d0dfa746b172540442852f74de4a9deacc433b
• https://github.com/livebook-dev/livebook/security/advisories/GHSA-74j5-6grg-g6wj
• https://osv.dev/vulnerability/EEF-CVE-2026-68746