Astron Agent Patch Fixes Critical Root Privilege Escalation for Tenants

Astron Agent version 1.1.2 addresses a critical security flaw that allowed authenticated low-privilege tenants to execute arbitrary code with root privileges. The vulnerability, tracked as CVE-2026-108263, stems from the platform’s default configuration for workflow code execution, which failed to enforce documented sandbox restrictions.

How does the vulnerability work?

The issue exists in the core workflow engine where the LocalExecutor selects Python builtins for dynamic code execution. According to the NVD record, if the CODE_EXEC_TYPE variable is not explicitly changed, the system defaults to this unsafe executor. This occurs through the /console-api/workflow/code/run and /workflow/v1/run endpoints, exposing the underlying container environment to untrusted input from authenticated users.

What is the impact on tenants?

An attacker with a low-privilege tenant account can execute code as root within the core-workflow container. This access allows them to utilize shared service and database credentials, effectively bypassing application-level tenant isolation. Consequently, threat actors can read or modify data belonging to other tenants and disrupt shared services hosted on the same infrastructure.

Which versions are affected?

The vulnerability impacts all versions of iflytek astron-agent prior to 1.1.2. The National Vulnerability Database lists the CVSS score as 9.9, categorizing the severity as critical. The underlying weaknesses include improper neutralization of directives, broken authentication, and insufficient access control, among others.

Is there a fix available?

Yes, the vendor has released version 1.1.2 to resolve this issue. Users running earlier versions should upgrade immediately to restore proper sandbox restrictions and prevent unauthorized code execution. The patch ensures that the LocalExecutor does not supply complete Python builtins without the necessary safety constraints.

What to do and how to stay safe: Astron Agent

• Verify if your Astron Agent deployment is running a version older than 1.1.2.
• Upgrade to version 1.1.2 or later to apply the vendor's security patch.
• Audit logs for unexpected code execution or privilege escalation attempts.
• Review network segmentation to limit lateral movement if a tenant is compromised.

Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-108263?

It is a critical vulnerability in Astron Agent that allows authenticated users to execute code as root due to missing sandbox restrictions.

Is a patch available for this issue?

Yes, the issue is fixed in Astron Agent version 1.1.2.

Can low-privilege users exploit this flaw?

Yes, authenticated low-privilege tenants can execute code as root and access shared credentials.