CVE-2026-108263
Astron Agent: Unsandboxed code-node leads to cross-tenant RCE
- State
- Published
- Severity
- 9.9 Critical
- Published
- Oct 9, 2026
- Updated
- Oct 13, 2026
- Reserved
- Oct 9, 2026
Description
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | GitHub_M |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
astron-agentiflytek |
|
References
- https://github.com/iflytek/astron-agent/security/advisories/GHSA-mh3w-4q3f-2fg5
- https://github.com/iflytek/astron-agent/pull/1650
- https://github.com/iflytek/astron-agent/pull/1651
- https://github.com/iflytek/astron-agent/commit/848daba03e5e045435863815be7ab6dfbcefc18f
- https://github.com/iflytek/astron-agent/commit/ebf074a431e96da0ad9e0a56409d3d2da15eae36
- https://github.com/iflytek/astron-agent/releases/tag/v1.1.2
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.