Vantage6 vulnerabilities
We track 8 vulnerabilities in Vantage6 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on August 13, 2026.
Latest Vantage6 vulnerabilities
- 7.1 High severity
vantage6: Incorrect Authorization
vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending o
- 7.5 High severity
vantage6: Use of Insufficiently Random Values
vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to
- 9.8 Critical severity
vantage6: Improper Restriction of Excessive Authentication Attempts
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by us
- 9.8 Critical severity
vantage6: Improper Access Control
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper
- 8.8 High severity
vantage6: Improper Control of Generation of Code
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote
- 8.8 High severity
vantage6: Insufficient Verification of Data Authenticity
vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that
- 7.2 High severity
vantage6: Deserialization of Untrusted Data
vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default s
- 8.8 High severity
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange.
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.