A critical authentication bypass vulnerability tracked as CVE-2026-111823 (CVSS v3.1 score: 9.8, Critical) has been uncovered in Mage OSS, the widely adopted open-source data pipeline and ETL orchestrator. The vulnerability allows unauthenticated remote adversaries to bypass Single Sign-On (SSO) authentication mechanisms and gain complete administrative access to enterprise data pipelines, connected data warehouses, and backend computing infrastructure.

Vulnerability Mechanics & Technical Root Cause (CWE-287 / CWE-390)

Mage OSS provides data engineering teams with an interactive web UI and API engine for composing, scheduling, and monitoring Python, SQL, and R data pipelines. To support enterprise identity providers, Mage implements OAuth 2.0 and OpenID Connect (OIDC) callback handlers (e.g., Okta, Azure AD, Google Workspace).

The vulnerability resides within Mage's session initialization logic in mage_ai/api/resources/OauthSessionResource.py. When a client initiates an OAuth session, the backend checks the requested provider against configured identity mappings. However, in versions prior to commit 76c4f46, if an unauthenticated request supplied an unrecognized or blank provider name, the exception handling routine caught the resolution error but failed to abort the transaction. Instead, the execution flow cascaded directly into default session token creation:

# Simplified representation of vulnerable OAuth session logic
class OauthSessionResource:
    def create(self, payload):
        provider = payload.get('provider')
        user = None
        try:
            user = get_user_from_oauth_provider(provider, payload.get('token'))
        except Exception:
            # VULNERABILITY: Error logged, but execution proceeds to instantiate session!
            logger.warning(f"Failed to verify provider {provider}")
            
        # If user is None and auto-provisioning is enabled, assigns default admin context!
        session = Session.create(user=user or get_default_owner_user())
        return session.token

Blast Radius: From Pipeline Access to Full Cloud Compromise

Because data pipeline orchestrators inherently manage privileged credentials for operational data lakes (Snowflake, BigQuery, AWS S3, PostgreSQL, Databricks), gaining administrative access to Mage OSS has devastating consequences:

  • Secret Exfiltration: Attackers can read plaintext environment variables and secret stores containing AWS IAM access keys, database passwords, and third-party API tokens.
  • Arbitrary Python Code Execution: Mage allows pipeline developers to author custom Python blocks. An authenticated administrative attacker can execute arbitrary OS shell commands inside the container runner.
  • Data Poisoning & Exfiltration: Threat actors can inject malicious SQL transforms or exfiltrate customer PII directly from connected transactional databases.

Remediation & Hardening Playbook

Data engineering and DevSecOps teams should take the following remediation steps immediately:

  1. Deploy Patched Container Images: Upgrade Mage instances to release 0.9.80 (or commit 76c4f467f3654041d8899b1c4447a985710d26c0): 
    # Update Docker deployment
docker pull mageai/mageai:latest
docker stop mage-instance && docker rm mage-instance
docker run -d -p 6789:6789 -v $(pwd):/home/src mageai/mageai:latest mage start [project_name]
  2. Enforce Ingress Network Controls: Never expose port 6789 directly to the public internet. Deploy Mage behind an identity-aware proxy (e.g., Cloudflare Access, AWS Verified Access, or Tailscale).
  3. Credential Rotation: If a vulnerable Mage instance was accessible without network perimeter protections, rotate all database passwords, cloud IAM service accounts, and API keys stored in Mage pipeline environment configs.