{"id":9063,"date":"2026-11-15T16:21:34","date_gmt":"2026-11-15T16:21:34","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands"},"modified":"2026-11-15T16:21:34","modified_gmt":"2026-11-15T16:21:34","slug":"cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands","title":{"rendered":"CVE-2026-129428: Pulse read-only viewers could approve AI assistant commands"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Pulse published advisory GHSA-9vxw-m79f-gxxr on 13 November 2026 for a missing authorization flaw reported by naroSEC. Versions 5.0.17 through 6.7.0 let an authenticated user holding only viewer access in an organization list pending AI Assistant approval requests and approve or deny them. VulnCheck assigned CVE-2026-129428 the next day.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> Pulse versions 5.0.17 through 6.7.0 let any signed-in viewer approve or deny AI assistant commands without checking approval permission<\/li><li><strong>Who is affected:<\/strong> Self-hosted Pulse installations with the AI Assistant in use and more than one user in an organization<\/li><li><strong>What to do:<\/strong> Upgrade to Pulse v6.8.0, published on 13 November 2026<\/li><li><strong>Workaround:<\/strong> Grant viewer access only to users who should be able to see and decide pending approvals<\/li><li><strong>Fixed in:<\/strong> Version 6.8.0, first fixed prerelease v6.8.0-rc.2<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pulse is a dashboard that lets you monitor servers and containers. It has an AI assistant that can run commands, but those commands need approval first. The bug let anyone who could log in and view the dashboard approve or deny those commands, even if they were only supposed to look, not decide. This means a viewer could see what commands the AI wanted to run and say yes or no, changing what actually happens and the record of who approved it. If you run Pulse with the AI assistant turned on and have multiple users, you should upgrade to version 6.8.0. If you don&#8217;t use Pulse, you can ignore this.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The approval routes in Pulse checked authentication, API token scopes, organization membership and request state, but never checked whether the signed-in user held approval permission. API tokens remained subject to their own scope checks, so the gap reached browser sessions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The fix in pull request 4127 requires the same approval permission already used for the Actions review before a session can list, approve or deny a request.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The advisory states that this path does not by itself establish cross-organization access or command execution on a host. A viewer could read the proposed commands and target details in other users&#8217; pending requests, and could approve or deny unexpired pending requests, which changes the approval decision and the audit record.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Upgrade to Pulse v6.8.0, published on 13 November 2026. Until the upgrade lands, the maintainer&#8217;s workaround is to grant viewer access only to users who should be able to see and decide pending approvals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To tell whether your Pulse instance was affected, compare the running version against the advisory&#8217;s range: v5.0.17 through v6.7.0 and the v6.8.0 prereleases beta.1, beta.2 and rc.1 are affected, and v6.8.0-rc.2 is the first fixed prerelease. The workaround points at the viewer role, so also review which users hold viewer access in each organization.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pulse is self-hosted monitoring for Proxmox VE, PBS and PMG, Docker, Kubernetes, TrueNAS and vSphere, and it also exposes an MCP server for coding agents. Installations on v5.0.17 through v6.7.0, plus the v6.8.0-beta.1, beta.2 and rc.1 prereleases, with the AI Assistant in use and more than one user in an organization are affected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The GitHub advisory assigned a CVSS score of 5.4 and classified the weakness as CWE-862, missing authorization.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/theinjection.dev\/items\/pulse-assistant-approval-authorization\/\" target=\"_blank\" rel=\"noreferrer noopener\">Pulse: read-only viewers could decide the assistant&#8217;s approvals<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Pulse, a self-hosted dashboard for Proxmox, Docker and Kubernetes, let any signed-in viewer list, approve or deny the AI assistant&#8217;s pending command approvals. Version 6.8.0 adds the missing permission check.<\/p>\n","protected":false},"author":2,"featured_media":9062,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"Pulse v5.0.17 through v6.7.0, plus v6.8.0 prereleases beta.1, beta.2 and rc.1","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: Pulse viewers could approve AI commands","_nx_sec_type":"mcp","_nx_sec_vendor":"Pulse","_nx_sec_fixed":"6.8.0","_nx_sec_action":""},"categories":[14,65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-9063","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-129428: Pulse AI assistant approval bypass<\/title>\n<meta name=\"description\" content=\"CVE-2026-129428 let any signed-in Pulse viewer approve or deny AI assistant commands. Versions 5.0.17 through 6.7.0 affected, fixed in 6.8.0.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-129428: Pulse AI assistant approval bypass\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-129428 let any signed-in Pulse viewer approve or deny AI assistant commands. Versions 5.0.17 through 6.7.0 affected, fixed in 6.8.0.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-15T16:21:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-129428: Pulse read-only viewers could approve AI assistant commands\",\"datePublished\":\"2026-11-15T16:21:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands\"},\"wordCount\":541,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands-title.webp\",\"articleSection\":[\"Agents\",\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-15T16:21:34+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands\",\"name\":\"CVE-2026-129428: Pulse AI assistant approval bypass\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands-title.webp\",\"datePublished\":\"2026-11-15T16:21:34+00:00\",\"description\":\"CVE-2026-129428 let any signed-in Pulse viewer approve or deny AI assistant commands. Versions 5.0.17 through 6.7.0 affected, fixed in 6.8.0.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-129428: Pulse read-only viewers could approve AI assistant commands\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-129428: Pulse AI assistant approval bypass","description":"CVE-2026-129428 let any signed-in Pulse viewer approve or deny AI assistant commands. Versions 5.0.17 through 6.7.0 affected, fixed in 6.8.0.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-129428: Pulse AI assistant approval bypass","og_description":"CVE-2026-129428 let any signed-in Pulse viewer approve or deny AI assistant commands. Versions 5.0.17 through 6.7.0 affected, fixed in 6.8.0.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands","og_site_name":"i10X News","article_published_time":"2026-11-15T16:21:34+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-129428: Pulse read-only viewers could approve AI assistant commands","datePublished":"2026-11-15T16:21:34+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands"},"wordCount":541,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands-title.webp","articleSection":["Agents","AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-15T16:21:34+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands","name":"CVE-2026-129428: Pulse AI assistant approval bypass","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands-title.webp","datePublished":"2026-11-15T16:21:34+00:00","description":"CVE-2026-129428 let any signed-in Pulse viewer approve or deny AI assistant commands. Versions 5.0.17 through 6.7.0 affected, fixed in 6.8.0.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-129428-pulse-read-only-viewers-could-approve-ai-assistant-commands#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-129428: Pulse read-only viewers could approve AI assistant commands"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/9063","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=9063"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/9063\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/9062"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=9063"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=9063"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=9063"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=9063"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=9063"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}