CVE-2026-108864lowCWE-639

CVE-2026-108864: low-severity vulnerability in iflytek astron-agent

iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint

Published · Updated

Follow this CVE+ Monitor astron-agent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.3epss 0.2%
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
iflytek · astron-agent
Related CVEs — iflytek astron-agent

In the same product, most dangerous first.

CVE-2026-82475HIGHiFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership CheckEPSS 0.4%CVE-2026-108263CRITICALAstron Agent: Unsandboxed code-node leads to cross-tenant RCEEPSS 0.4%