CVE-2026-108263

Summary

Astron Agent's LocalExecutor allows authenticated low-privilege users to execute arbitrary Python code with root privileges in the core-workflow container, bypassing tenant isolation and accessing shared resources. This creates a critical privilege escalation vulnerability that can lead to data breaches and service disruption.

Exploitability

Exploitation is straightforward for authenticated users with low privileges, requiring only access to the /console-api/workflow/code/run or /workflow/v1/run endpoints with default configuration settings.

Blast radius

The vulnerability can affect all tenants sharing the same workflow container, potentially allowing attackers to read, modify, or delete data from multiple tenants while also disrupting shared services and databases.

Detection

Monitor for unauthorized code execution attempts in workflow engine logs, specifically looking for execution of dynamic Python code through the /console-api/workflow/code/run and /workflow/v1/run endpoints with elevated privileges.

Prioritized remediation

Upgrade to version 1.1.2 immediately to fix the code execution sandboxing issue in LocalExecutor.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.