Tenants Steal Credentials via Astron Agent Critical Root Flaw in Versions Before 1.1.2

A critical vulnerability in Astron Agent exposes small-business deployments to severe data breaches and service disruption. According to the National Vulnerability Database, CVE-2026-108263 allows authenticated users with low privileges to execute code as root. This flaw enables attackers to bypass application-level tenant checks and access shared service credentials, compromising the isolation between different users on the platform.

The risk

The vulnerability stems from how Astron Agent handles dynamic code execution in its workflow engine. Prior to version 1.1.2, the platform selects LocalExecutor when the CODE_EXEC_TYPE configuration is not explicitly changed. This default behavior applies to requests made through the /console-api/workflow/code/run and /workflow/v1/run endpoints. According to the NVD record, LocalExecutor supplies complete Python builtins to the execution environment. This setup ignores the documented sandbox restrictions that are supposed to limit what code can access.

An attacker can exploit this by injecting malicious Python code into a workflow. Because the code runs with root privileges inside the core-workflow container, it has unrestricted access to the host system’s resources. The NVD lists associated weaknesses including CWE-95, CWE-306, CWE-653, CWE-863, and CWE-1392. These classifications highlight issues with improper neutralization of directives and insufficient session management.

Who is exposed

Any organization running Astron Agent versions earlier than 1.1.2 is vulnerable to this attack. The platform is designed as an agentic workflow system for building and running AI agents. Small businesses using this tool to automate tasks may unknowingly expose their infrastructure. The risk is heightened because the vulnerable configuration is the default setting. Users who have not manually altered the CODE_EXEC_TYPE parameter are relying on a broken security model.

An authenticated low-privilege tenant is sufficient to trigger the exploit. The attacker does not need administrative rights to the entire platform. Once inside, they can read or modify data belonging to other tenants. They can also disrupt shared services by leveraging the credentials stored in the container. This breaks the fundamental promise of multi-tenant isolation.

Cost and compliance

The National Vulnerability Database rates the severity of CVE-2026-108263 as critical with a CVSS score of 9.9. This high score reflects the ease of exploitation and the severe impact on confidentiality and integrity. Organizations must assess their exposure against compliance frameworks that require strict data segregation. Failure to isolate tenant data could violate contractual obligations and regulatory standards for data protection.

What happens next

Managers should immediately verify their Astron Agent version to determine if they are running a vulnerable build. If the version is prior to 1.1.2, they should plan an urgent upgrade to patch the flaw. Until the update is applied, restricting access to the workflow endpoints may reduce the attack surface. Monitoring logs for unusual code execution patterns can help detect active exploitation attempts.

Background: National Vulnerability Database

The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.

Read the full guide: National Vulnerability Database Explained: How NVD Works for You

What to do and how to stay safe: Astron Agent

• Audit your Astron Agent installation to confirm the current version and check if it is earlier than 1.1.2.
• Review access logs for the /console-api/workflow/code/run and /workflow/v1/run endpoints for suspicious activity.
• Restrict network access to these API endpoints to trusted internal IP addresses until a patch is deployed.
• Once the vendor provides an update, apply version 1.1.2 or later to fix the root privilege escalation issue.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-108263?

It is a critical vulnerability in Astron Agent that allows authenticated users to execute code as root due to improper sandboxing.

Which versions of Astron Agent are affected?

All versions prior to 1.1.2 are affected by this vulnerability.

Is there a fix available?

Yes, the issue is fixed in version 1.1.2 of Astron Agent.