CVE-2026-108864lowCWE-639

CVE-2026-108864: falha de baixa gravidade em iflytek astron-agent

iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar astron-agent

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.3epss 0.2%
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
iflytek · astron-agent
CVEs relacionadas — iflytek astron-agent

No mesmo produto, das mais perigosas para as menos.

CVE-2026-82475HIGHiFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership CheckEPSS 0.4%CVE-2026-108263CRITICALAstron Agent: Unsandboxed code-node leads to cross-tenant RCEEPSS 0.4%