LOW 2.3 NVD
CVE-2026-108864
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other application
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation.
References
- https://github.com/iflytek/astron-agent
- https://github.com/iflytek/astron-agent/blob/v1.1.2/core/workflow/api/v1/chat/open.py#L106
- https://github.com/iflytek/astron-agent/blob/v1.1.2/core/workflow/cache/event_registry.py
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/iflytek-astron-agent-cross-app-workflow-resume
- https://www.vulncheck.com/advisories/iflytek-astron-agent-through-1.1.2-authorization-bypa
This low severity vulnerability with a CVSS score of 2.3 was published on 2026-10-11 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.