Attributed metadata history
Up to 100 retained publisher events per page for 9c00a83b1f689f92fb589e01448284463e2d95020bc45c1f2219025d700483da. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:04 UTC
Cosmos DB notebooks lacked an authentication check, meaning that if an attacker somehow had prior knowledge of a notebook’s temporary ‘forwardingId’ (a 128bit cryptographically random GUID assigned to a short-lived workspace that expires after an hour), they could gain full permissions on the notebook, including read and write access and the ability to modify the file system of the container running the notebook. These permissions would suffice for an attacker to obtain remote code execution (RCE) in the notebook container. However, this would not allow an attacker to execute notebooks, automatically save notebooks in the victim’s (optionally) connected GitHub repository, or access data in the Cosmos DB account. Following disclosure, Cosmos DB notebooks now require an authorization token in the request header before allowing access.
Fingerprint: 24690b4132cf5a0c886b5a27a6464c8fdeed7c4b762f8136a0a96c5bcbc0a169
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
available
Fingerprint: 46fd50ac705e064c7517d97d61b5ec511c9b1ada6209622159dd39573ba08e5c