CVE-2026-129428

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-129428

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129428.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-129428

Aliases

GHSA-9vxw-m79f-gxxr

Published

2026-11-14T12:32:56Z

Modified

2026-11-15T02:46:44Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Pulse 5.0.17 before 6.8.0 Missing Authorization via AI Assistant Approval API

Details

Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that allows authenticated viewer-level users to manage approval requests. Attackers can list pending requests to expose proposed commands and targets, and approve or deny other users' requests, altering decision and audit state.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129428.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "5.0.17"
                        },
                        {
                            "fixed": "6.8.0"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "5.0.17"
                        },
                        {
                            "fixed": "6.8.0"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/rcourtman/pulse

Affected ranges

Type

GIT

Repo

https://github.com/rcourtman/pulse

Events

Introduced

Fixed

f05119d97ea3bc1980886d8c62dda7ce8fd39d4e

Fixed

b2d5125dda21084f26ce19d04009e277e21414a8

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "f05119d97ea3bc1980886d8c62dda7ce8fd39d4e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v6.8.0",
            "range": [
                {
                    "fixed": "b2d5125dda21084f26ce19d04009e277e21414a8"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

4.*

4.26.4

helm-chart-4.*

helm-chart-4.28.0

helm-chart-4.29.5

helm-chart-4.30.0

helm-chart-4.31.0

helm-chart-4.32.0

helm-chart-4.32.1

helm-chart-4.32.2

helm-chart-4.32.3

helm-chart-4.32.4

helm-chart-4.32.7

helm-chart-4.33.0

helm-chart-4.33.1

helm-chart-5.*

helm-chart-5.0.0

helm-chart-5.0.0-rc.2

helm-chart-5.0.0-rc.3

helm-chart-5.0.0-rc.4

helm-chart-5.0.1

helm-chart-5.0.10

helm-chart-5.0.11

helm-chart-5.0.13

helm-chart-5.0.14

helm-chart-5.0.15

helm-chart-5.0.16

helm-chart-5.0.17

helm-chart-5.0.2

helm-chart-5.0.4

helm-chart-5.0.5

helm-chart-5.0.6

helm-chart-5.0.7

helm-chart-5.0.8

helm-chart-5.0.9

helm-chart-5.1.0

helm-chart-5.1.0-rc.1

helm-chart-5.1.0-rc.2

helm-chart-5.1.1

helm-chart-5.1.10

helm-chart-5.1.11

helm-chart-5.1.12

helm-chart-5.1.13

helm-chart-5.1.14

helm-chart-5.1.15

helm-chart-5.1.16

helm-chart-5.1.17

helm-chart-5.1.18

helm-chart-5.1.19

helm-chart-5.1.2

helm-chart-5.1.20

helm-chart-5.1.21

helm-chart-5.1.22

helm-chart-5.1.23

helm-chart-5.1.24

helm-chart-6.*

helm-chart-6.0.1

helm-chart-6.0.4

helm-chart-6.0.5

helm-chart-6.0.5-rc.1

helm-chart-6.0.5-rc.2

helm-chart-6.0.5-rc.3

helm-chart-6.2.0

helm-chart-6.2.1

helm-chart-6.2.2-rc.1

helm-chart-6.2.2-rc.2

helm-chart-6.3.0

helm-chart-6.3.0-rc.2

helm-chart-6.3.0-rc.3

helm-chart-6.3.0-rc.4

helm-chart-6.3.0-rc.5

helm-chart-6.3.0-rc.6

helm-chart-6.3.1

helm-chart-6.4.0

helm-chart-6.4.0-rc.1

helm-chart-6.4.0-rc.10

helm-chart-6.4.0-rc.12

helm-chart-6.4.0-rc.3

helm-chart-6.4.0-rc.4

helm-chart-6.4.0-rc.5

helm-chart-6.4.0-rc.6

helm-chart-6.4.0-rc.7

helm-chart-6.4.1

Other

issue-706

untagged-ab76625c2d9026170f80

v4.*

v4.22.0

v4.23.0

v4.24.0

v4.24.0-rc.1

v4.24.0-rc.2

v4.24.0-rc.3

v4.25.0

v4.26.1

v4.26.2

v4.26.3

v4.26.4

v4.26.5

v4.28.0

v4.29.5

v4.30.0

v4.31.0

v4.32.0

v4.32.1

v4.32.2

v4.32.3

v4.32.4

v4.32.5

v4.32.7

v4.33.0

v4.33.1

v4.34.0

v4.34.1

v4.35.0

v4.36.0

v4.36.1

v4.36.2

v5.*

v5.0.0

v5.0.0-rc.1

v5.0.0-rc.2

v5.0.0-rc.3

v5.0.0-rc.4

v5.0.1

v5.0.10

v5.0.11

v5.0.13

v5.0.14

v5.0.15

v5.0.16

v5.0.17

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.6

v5.0.7

v5.0.8

v5.0.9

v5.1.0

v5.1.0-rc.1

v5.1.0-rc.2

v5.1.1

v5.1.10

v5.1.11

v5.1.12

v5.1.13

v5.1.14

v5.1.15

v5.1.16

v5.1.17

v5.1.18

v5.1.19

v5.1.2

v5.1.20

v5.1.21

v5.1.22

v5.1.23

v5.1.24

v5.1.3

v5.1.4

v5.1.5

v5.1.6

v5.1.7

v5.1.8

v5.1.9

v6.*

v6.0.0

v6.0.0-rc.1

v6.0.0-rc.2

v6.0.0-rc.3

v6.0.0-rc.4

v6.0.0-rc.5

v6.0.0-rc.6

v6.0.0-rc.7

v6.0.1

v6.0.2

v6.0.3

v6.0.4

v6.0.4-rc.1

v6.0.4-rc.2

v6.0.5

v6.0.5-rc.1

v6.0.5-rc.2

v6.0.5-rc.3

v6.0.5-rc.4

v6.1.0

v6.1.0-rc.1

v6.1.0-rc.2

v6.1.0-rc.3

v6.1.0-rc.4

v6.1.1

v6.1.2

v6.2.0

v6.2.0-rc.1

v6.2.0-rc.10

v6.2.0-rc.11

v6.2.0-rc.2

v6.2.0-rc.3

v6.2.0-rc.4

v6.2.0-rc.5

v6.2.0-rc.6

v6.2.0-rc.7

v6.2.0-rc.8

v6.2.0-rc.9

v6.2.1

v6.2.2-rc.1

v6.2.2-rc.2

v6.3.0

v6.3.0-rc.2

v6.3.0-rc.3

v6.3.0-rc.4

v6.3.0-rc.5

v6.3.0-rc.6

v6.3.1

v6.4.0

v6.4.0-rc.1

v6.4.0-rc.10

v6.4.0-rc.12

v6.4.0-rc.2

v6.4.0-rc.3

v6.4.0-rc.4

v6.4.0-rc.5

v6.4.0-rc.6

v6.4.0-rc.7

v6.4.0-rc.9

v6.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129428.json"