Astron Agent Unsandboxed Code Node Leads to Cross-Tenant RCE (CVE-2026-108263)

Vulnerability Overview Vulnerability Name: Unsandboxed code-node leads to cross-tenant RCE CVE ID: CVE-2026-108263 CVSS v3 base metrics: 9.9 / 10 Severity: Critical Description: This vulnerability exists in Astron Agent v1.1.1 and earlier. When using legacy unsandboxed workflow code nodes, multi-tenant deployments are exposed to cross-tenant data access risks, while single-tenant deployments are affected by code execution and credential exposure risks. Affected Scope Affected Product: Astron Agent (iftyk/astron-agent) Affected Versions: <= v1.1.1 Fixed Version: v1.1.2 Remediation Upgrade Guide: Operators are advised to upgrade to v1.1.2 or later. Secure Release and Upgrade Instructions: See the GitHub Release Page. Patch Details Patch Content: The patch version rejects insecure local code execution and enables the built-in isolated LangChain/Pydide executor by default. E2B remains optional. The patch also strengthens internal workflow and tenant API authentication, credential checks, credential handling, and deployment isolation. Executor Migration: The executor was migrated to the branch (via #1655) and hardening was performed. The reporter tested on the v1.1.2 branch and confirmed the fix is effective. Upgrade Guide Backup: Backup the database, persistent data, and configuration before upgrading. Update: Update the Compose deployment file, service configurations, gateway configuration, and all service integrations, retaining site-specific settings. For Docker Compose, set . Verification: Verify that service health and workflow code node execution are functioning correctly after the upgrade. Original Vulnerability Report Summary The unsandboxed code evaluation vulnerability allows the default workflow code node executor to execute arbitrary code as root within the container, and read and modify data from other tenants from within it. The executor is documented as using RestrictedPython for secure execution, but RestrictedPython is not a project dependency, nor does it implement any restrictions. Details 1. Default executor is not sandboxed - The description mentions using and "secure code execution," but this is not actually implemented. 2. is the default - The default configuration selects as the backend. 3. Flat network with default superuser credentials - All services are placed on a single bridge, using default superuser credentials. 4. Cross-tenant authorization is bypassed, not broken - The console authorization logic is correct, but code nodes use credentials directly, leading to cross-tenant access. 5. Internal execution routes require no authentication - Internal execution routes are not protected by authentication, leading to unauthorized access. POC Code Impact Vulnerability Class: A combination of unsandboxed untrusted code evaluation (CWE-95) and tenant isolation failure (CWE-613), default superuser credentials (CWE-798) on a shared network, and lack of authentication controls for internal routes (CWE-306). Affected Users: All multi-tenant Astron Agent deployments using the default stack, all versions <= v1.1.1. Single-tenant deployments face risks of code execution and credential exposure, but do not involve cross-tenant access. Utilizer: Any authenticated user allowed to build workflows, without needing admin roles or container escape. Attainable by Attacker: - Arbitrary code execution as inside the container - Direct MySQL access as , PostgreSQL as superuser , unauthenticated Redis and MinIO - Reading other tenants' secrets and data, bypassing console authorization - Modifying and deleting other tenants' data - Denial of Service (DoS) against the entire platform by consuming or exhausting resources - Stealing hardcoded tenant secrets, such as Acknowledgments Thanks to Noy Pearl and the Lasso Security team for disclosure, collaborative fixing, and verification. The honor remains with the reporter.

Goal Reached Thanks to every supporter — we hit 100%!

Astron Agent Unsandboxed Code Node Leads to Cross-Tenant RCE (CVE-2026-108263)

More from this source