OtterMind Nubase: Missing authentication in storage object API

Summary

OtterMind Nubase through 0.1.4 treats the storage object endpoint /storage/v1/object/{bucketId}/{path} as public for every HTTP method, so no login is required. An unauthenticated attacker who knows a tenant subdomain, bucket ID and object path can download objects from private buckets and delete stored objects without an apikey or JWT. The CVE is scored CVSS 4.0 8.3 (High), and CISA SSVC lists exploitation as none.

Affected

• OtterMind Nubase 0 to 0.1.4 (inclusive), per the CVE record
• Source code reviewed: tag v0.1.4

Fixed in

Unknown. No fixed version or vendor security advisory was found.

Workaround

• Do not expose the Nubase storage API directly to the internet. Restrict access to VPN or internal networks, or allow-list it at a reverse proxy.
• Block unauthenticated requests to /storage/v1/object/ at the proxy level where the application does not need them (verify this against your deployment first).
• Review which buckets are private and what they contain.

Exploitation

• No evidence of active exploitation was found, and no CISA KEV listing was found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
• A third-party write-up is referenced. Its content was not verified, and a public proof of concept is unconfirmed.

Our recommendation

• Check whether any Nubase instance is deployed and whether it is reachable from the internet.
• If it is exposed and no vendor fix exists, restrict access now.
• Review logs of the storage endpoint for unexpected object downloads and deletions.
• If exposure is suspected, rotate secrets and credentials that were stored in affected buckets.
• Ask the vendor for a fix timeline and monitor the GitHub releases page.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• OSV: CVE-2026-111701 osv.dev
• VulDB: CVE-2026-111701 vuldb.com
• Nubase StorageObjectReadController.java at v0.1.4 github.com
• Nubase StorageService.java at v0.1.4 github.com
• Nubase UnifiedMultiTenancyFilter.java at v0.1.4 github.com
• Third-party write-up (HackMD, unverified) hackmd.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:37.