{"id":"CVE-2026-108263","published":"2026-10-09T21:17:04.527","lastModified":"2026-10-13T21:17:34.110","description":"Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-95","CWE-306","CWE-653","CWE-863","CWE-1392"],"vendors":[],"products":[],"references":[{"url":"https://github.com/iflytek/astron-agent/commit/848daba03e5e045435863815be7ab6dfbcefc18f","tags":[]},{"url":"https://github.com/iflytek/astron-agent/commit/ebf074a431e96da0ad9e0a56409d3d2da15eae36","tags":[]},{"url":"https://github.com/iflytek/astron-agent/pull/1650","tags":[]},{"url":"https://github.com/iflytek/astron-agent/pull/1651","tags":[]},{"url":"https://github.com/iflytek/astron-agent/releases/tag/v1.1.2","tags":[]},{"url":"https://github.com/iflytek/astron-agent/security/advisories/GHSA-mh3w-4q3f-2fg5","tags":[]}],"exploitRefs":[{"url":"https://github.com/iflytek/astron-agent/commit/848daba03e5e045435863815be7ab6dfbcefc18f","tags":[]},{"url":"https://github.com/iflytek/astron-agent/commit/ebf074a431e96da0ad9e0a56409d3d2da15eae36","tags":[]},{"url":"https://github.com/iflytek/astron-agent/pull/1650","tags":[]},{"url":"https://github.com/iflytek/astron-agent/pull/1651","tags":[]},{"url":"https://github.com/iflytek/astron-agent/releases/tag/v1.1.2","tags":[]},{"url":"https://github.com/iflytek/astron-agent/security/advisories/GHSA-mh3w-4q3f-2fg5","tags":[]}],"hasPoc":true,"ai":{"summary":"Astron Agent's LocalExecutor allows authenticated low-privilege users to execute arbitrary Python code with root privileges in the core-workflow container, bypassing tenant isolation and accessing shared resources. This creates a critical privilege escalation vulnerability that can lead to data breaches and service disruption.","exploitability":"Exploitation is straightforward for authenticated users with low privileges, requiring only access to the /console-api/workflow/code/run or /workflow/v1/run endpoints with default configuration settings.","blast_radius":"The vulnerability can affect all tenants sharing the same workflow container, potentially allowing attackers to read, modify, or delete data from multiple tenants while also disrupting shared services and databases.","remediation":"Upgrade to version 1.1.2 immediately to fix the code execution sandboxing issue in LocalExecutor.","detection":"Monitor for unauthorized code execution attempts in workflow engine logs, specifically looking for execution of dynamic Python code through the /console-api/workflow/code/run and /workflow/v1/run endpoints with elevated privileges.","tags":["rce","privilege-escalation","tenant-isolation","workflow-engine"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:42:46.428Z"}}