{"id":"CVE-2026-108263","aliases":["EUVD-2026-95992","GHSA-mh3w-4q3f-2fg5"],"status":"published","title":"Astron Agent: Unsandboxed code-node leads to cross-tenant RCE","description":"Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00432,"percentile":0.37973,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1392","CWE-306","CWE-653","CWE-863","CWE-95"],"published":"2026-10-09T20:47:38Z","modified":"2026-10-28T11:06:14Z","products":[{"vendor":"iflytek","product":"astron-agent"}],"references":[{"url":"https://github.com/iflytek/astron-agent/security/advisories/GHSA-mh3w-4q3f-2fg5","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/iflytek/astron-agent/pull/1650","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/iflytek/astron-agent/pull/1651","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/iflytek/astron-agent/commit/848daba03e5e045435863815be7ab6dfbcefc18f","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/iflytek/astron-agent/commit/ebf074a431e96da0ad9e0a56409d3d2da15eae36","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/iflytek/astron-agent/releases/tag/v1.1.2","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108263.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108263","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-108263","title":"Astron Agent: Unsandboxed code-node leads to cross-tenant RCE","description":"Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.","status":"published","published":"2026-10-09T20:47:38.407Z","modified":"2026-10-13T20:25:35.552Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-95","CWE-306","CWE-653","CWE-863","CWE-1392"],"updated_at":"2026-11-02T14:20:10.510075Z"}],"euvd":[{"id":"EUVD-2026-95992","description":"Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.","status":"published","published":"2026-10-09T20:47:38Z","modified":"2026-10-13T20:25:35Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:18.393051Z"}],"nvd":[{"id":"CVE-2026-108263","description":"Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.","status":"published","published":"2026-10-09T21:17:04.527Z","modified":"2026-10-16T20:04:29.76Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-95","CWE-306","CWE-653","CWE-863","CWE-1392"],"updated_at":"2026-11-02T14:12:55.473789Z"}],"osv":[{"id":"CVE-2026-108263","title":"Astron Agent: Unsandboxed code-node leads to cross-tenant RCE","description":"Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.","status":"published","published":"2026-10-09T20:47:38.407Z","modified":"2026-10-28T11:06:14.666140319Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1392","CWE-306","CWE-653","CWE-863","CWE-95"],"updated_at":"2026-11-02T15:44:54.933106Z"}]}}