Is CVE-2026-54533 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54533 being exploited in the wild.

How severe is CVE-2026-54533?

Medium severity, with a CVSS score of 4, published 17 June 2026.

Which products and versions are affected?

vantage6 (PyPI) ECOSYSTEM:introduced=0,fixed=5.0.0.

Is there a fix for CVE-2026-54533?

Yes. vantage6 (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54533 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54533?

Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54533: vantage6 improper access control in algorithm containers

CVE-2026-54533 · Severity: medium · CVSS 4 · Published 2026-06-17

vantage6 is an open-source platform used for privacy-preserving data analysis across different organizations. A security flaw allows malicious analysis algorithms to bypass isolation and access the input and output files of other algorithms running on the same system. This could lead to the unauthorized exposure of sensitive research data or analysis results.

Technologies: vantage6 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54533 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54533 being exploited in the wild.
How severe is CVE-2026-54533?: Medium severity, with a CVSS score of 4, published 17 June 2026.
Which products and versions are affected?: vantage6 (PyPI) ECOSYSTEM:introduced=0,fixed=5.0.0.
Is there a fix for CVE-2026-54533?: Yes. vantage6 (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54533 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54533?: Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vantage6 (PyPI): upgrade to 5.0.0 or later
```
pip install "vantage6>=5.0.0"
```

Technical details

An improper access control vulnerability (CWE-284) exists in vantage6 nodes prior to version 5.0.0. The vulnerability allows a malicious algorithm container to access the file system resources, specifically input and output files, belonging to other algorithm containers. This occurs due to insufficient isolation between algorithm execution environments on the node. Attackers can exploit this by deploying a specially crafted algorithm to a node. The issue is resolved in version 5.0.0; users unable to upgrade should implement strict container whitelisting to restrict which algorithms are permitted to execute.

Affected products

vantage6 vantage6 < 5.0.0

Identifiers

CVE-2026-54533
GHSA-x9f6-9rvm-mmrg
PYSEC-2026-3401

Timeline

2026-06-17: disclosed
2026-06-17: advisory
2026-06-17: patched: Fixed in version 5.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.