CVE-2026-67348 Details

A cross-tenant insecure direct object reference vulnerability has been identified in Julep's 'get_execution_details' endpoint. This vulnerability allows authenticated tenants to access another tenant's execution data by supplying arbitrary 'execution_id' values. The exposed data includes sensitive execution records such as task inputs, outputs, metadata, and temporal task tokens from other tenants. This issue affects Julep versions prior to the commit '5371a62'.

The vulnerability can be remediated by adding a developer ID dependency to the 'get_execution_details' endpoint and modifying the execution query to filter by developer ID. This change would ensure that each tenant can only access their own execution data. Additionally, the related write path 'PUT /executions/{execution_id}' and transitions read routes should be reviewed for the same missing scope.