CVE-2026-108263 Details
Description
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.
A critical vulnerability exists in Astron Agent versions through 1.1.1, allowing authenticated low-privilege users to execute arbitrary code as root within the core-workflow container. This issue arises from the default 'local' code execution environment, which lacks proper sandboxing and instead provides full access to Python built-ins. Exploitation enables cross-tenant data access, bypassing application-level tenant checks, and could disrupt shared services. The vulnerability is particularly concerning in multi-tenant deployments, where it can be exploited to access and modify other tenants' data.
Users should upgrade to Astron Agent version 1.1.2, which addresses the vulnerability by changing the default code execution environment to a secure, sandboxed version. After upgrading, it's important to review and adjust any custom code execution settings to ensure they align with the new version's capabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/iflytek/astron-agent/commit/848daba03e5e045435863815be7ab6dfbcefc18f | [email protected] | Source CodeVendor |
| https://github.com/iflytek/astron-agent/commit/ebf074a431e96da0ad9e0a56409d3d2da15eae36 | [email protected] | Source CodeVendor |
| https://github.com/iflytek/astron-agent/pull/1650 | [email protected] | Issue TrackingVendor |
| https://github.com/iflytek/astron-agent/pull/1651 | [email protected] | Issue TrackingVendor |
| https://github.com/iflytek/astron-agent/releases/tag/v1.1.2 | [email protected] | AdvisoryRemedyVendor |
| https://github.com/iflytek/astron-agent/security/advisories/GHSA-mh3w-4q3f-2fg5 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1392 | Use of Default Credentials | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-653 | Improper Isolation or Compartmentalization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| iflytek Astron Agent | <= v1.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |