CVE-2026-108263criticalCWE-1392CWE-306CWE-653CWE-863CWE-95

CVE-2026-108263: critical vulnerability in iflytek astron-agent

Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

Published · Updated

Follow this CVE+ Monitor astron-agent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 0.4%
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
iflytek · astron-agent
Related CVEs — iflytek astron-agent

In the same product, most dangerous first.

CVE-2026-82475HIGHiFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership CheckEPSS 0.4%CVE-2026-108864LOWiFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume EndpointEPSS 0.2%