iFlytek Astron Agent: Unsandboxed code execution enables cross-tenant RCE
Summary
Astron Agent, an agentic workflow platform for building and running AI agents, runs code-node Python without the documented sandbox restrictions in its default configuration. An authenticated low-privilege tenant can execute code as root in the core-workflow container. The attacker can then use shared service and database credentials to bypass tenant checks, read or modify other tenants' data, and disrupt shared services.
Affected
- iFlytek Astron Agent versions before 1.1.2 (CNA data)
- VulDB describes the issue as up to 1.1.1; treat 1.1.1 and earlier as affected
Fixed in
- Upgrade to Astron Agent 1.1.2 or later (vendor release v1.1.2)
Workaround
Unknown.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- No public exploit found at the time of writing
- Not listed in the CISA KEV catalog at the time of writing
Our recommendation
- Identify all Astron Agent instances and their versions, including Docker images
- Upgrade to 1.1.2 or later and read the vendor advisory GHSA-mh3w-4q3f-2fg5 first
- Restrict who can create accounts or tenants, and limit access to the Console and workflow APIs to trusted networks
- Review logs for unusual code-node executions and check the core-workflow container
- Recheck the CVE record, the GHSA and the CISA KEV catalog in the coming days
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mh3w-4q3f-2fg5 github.com
- Astron Agent release v1.1.2 github.com
- Fix commit 848daba (PR #1651) github.com
- Fix commit ebf074a (PR #1650) github.com
- OSV record CVE-2026-108263 osv.dev
- VulDB CVE-2026-108263 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:35.
Original description (NVD)
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.
NVD references (6)
- https://github.com/iflytek/astron-agent/commit/848daba03e5e045435863815be7ab6dfbcefc18f
- https://github.com/iflytek/astron-agent/commit/ebf074a431e96da0ad9e0a56409d3d2da15eae36
- https://github.com/iflytek/astron-agent/pull/1650
- https://github.com/iflytek/astron-agent/pull/1651
- https://github.com/iflytek/astron-agent/releases/tag/v1.1.2
- https://github.com/iflytek/astron-agent/security/advisories/GHSA-mh3w-4q3f-2fg5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.