CVE-2026-14621
FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session
- State
- Published
- Severity
- 2.3 Low
- Published
- Jul 4, 2026
- Updated
- Jul 6, 2026
- Reserved
- Jul 3, 2026
Description
A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.1 Low | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 3.1 Low | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 2.1 Low | AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-488 Exposure of Data Element to Wrong Session
Affected Products
| Product | Versions |
|---|---|
FATEFederatedAI |
|
References
- VDB-376137 | FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong sessionvdb-entrytechnical-description
- VDB-376137 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-14621 | CVE Analysis and Reportthird-party-advisory
- Submit #844900 | FederatedAI FATE (OSX Broker) 5a06d9e4c4cd7ab97a5c8357828adbffaca87785 Improper Isolation / Cross-Tenant Data Exposurethird-party-advisory
- https://github.com/FederatedAI/FATE/issues/5791exploitissue-tracking
- https://github.com/FederatedAI/FATE/pull/5792issue-trackingpatch
- https://github.com/FederatedAI/FATE/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.