CVE-2026-63342

Summary

The flaw allows an authenticated user to read another tenant's durable task event logs by exploiting a misconfigured API endpoint, potentially revealing sensitive workflow details.

Exploitability

Exploitation requires access to an authenticated session and knowledge of another tenant’s durable task UUID; moderate difficulty due to authentication requirement but ease in identifying target tasks.

Blast radius

If exploited, the impact could be significant as it compromises the privacy and security of workflows, including display names, user messages, and timing information across different tenants.

Prioritized remediation

Update to version 0.91.1 or apply a patch that properly enforces tenant scope checks on API endpoints.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.