An improper access control flaw in the Vantage6 node software lets a malicious algorithm run on the node discover and read files belonging to other algorithms. The vulnerability stems from insufficient isolation between algorithm containers, violating confidentiality and potentially exposing sensitive data. The weakness is classified as CWE‑284, a classic example of access control failure.

All Vantage6 installations running any version before 5.0.0 are vulnerable. The fix was introduced in version 5.0.0; nodes running that or newer releases are not affected.

The CVSS score of 6.9 indicates a moderate to high risk. The EPSS score is under 1 %, suggesting that exploitation is currently considered unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to submit or otherwise deploy an algorithm container on the target node. Once a malicious algorithm is executed, it can traverse the node’s filesystem, accessing other algorithms’ input and output data. The impact is essentially the disclosure of private data that was supposed to remain isolated within each algorithm’s container.