Executive brief
vantage6 is an open-source platform used for privacy-preserving data analysis across different organizations. A security flaw allows malicious analysis algorithms to bypass isolation and access the input and output files of other algorithms running on the same system. This could lead to the unauthorized exposure of sensitive research data or analysis results.
Technical details
An improper access control vulnerability (CWE-284) exists in vantage6 nodes prior to version 5.0.0. The vulnerability allows a malicious algorithm container to access the file system resources, specifically input and output files, belonging to other algorithm containers. This occurs due to insufficient isolation between algorithm execution environments on the node. Attackers can exploit this by deploying a specially crafted algorithm to a node. The issue is resolved in version 5.0.0; users unable to upgrade should implement strict container whitelisting to restrict which algorithms are permitted to execute.
Affected products
- vantage6 vantage6 < 5.0.0
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched: Fixed in version 5.0.0