CVE-2026-108548mediumCWE-287

CVE-2026-108548: falha de média gravidade em iflytek astron-rpa

AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar astron-rpa

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.3%
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
iflytek · astron-rpa
CVEs relacionadas — iflytek astron-rpa

No mesmo produto, das mais perigosas para as menos.

CVE-2026-108159HIGHAstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC BridgeEPSS 0.3%CVE-2026-108547HIGHAstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-varEPSS 0.2%CVE-2026-110764MEDIUMAstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/downloadEPSS 0.2%CVE-2026-108160HIGHAstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP FeedEPSS 0.1%