Astron Agent’s v1.1.2 security release of September 7, 2026 describes a legacy local workflow code executor that let an authenticated user with workflow creation rights run code inside the workflow service container. In vulnerable multi-tenant configurations, that code could reach data belonging to other tenants, while single-tenant deployments retained the…
Inspect the ClaimsCase · DiggingBeagle record
Astron Agent legacy workflow executor could cross tenant boundaries
iFlytek patched a legacy unsandboxed Astron Agent code executor that exposed workflow-container execution and, in affected multi-tenant deployments, access to other tenants’ data.
Scope
Astron Agent versions through v1.1.1 using the legacy unsandboxed local executor; patched v1.1.2 requires coordinated service and configuration changes.
Assessment profile
Assessment method- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The September 7 vendor security release documents code-node isolation failure and versioned remediation. Its presence does not establish a deployed exploit, victim count, or independent reproduction of the researcher’s most severe claimed outcomes.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-AA-EXECUTOR-IMPACT · CLM-AA-RELEASE-FIX · CLM-AA-SCOPE · Astron Agent v1.1.2 security release
At a glance
The immediate boundary is between tenant-authored workflow code and the shared workflow service container. Moving code nodes into the isolated executor and applying internal service authorization blocks the vendor-described route, but updating only a front-end or leaving the legacy local executor explicitly enabled does not establish isolation.
Read the implicationsWhether custom overrides can recreate equivalent unsafe execution after upgrading. Independent confirmation of the researcher’s reported root-context test and cross-tenant database operations. Production exploitation and number of vulnerable installations.
Limits and uncertaintyFull account
Astron Agent’s v1.1.2 security release of September 7, 2026 describes a legacy local workflow code executor that let an authenticated user with workflow creation rights run code inside the workflow service container. In vulnerable multi-tenant configurations, that code could reach data belonging to other tenants, while single-tenant deployments retained the host-container execution risk. The vendor changed the default to an isolated LangChain/Pyodide executor, strengthened internal service checks and documented full-stack upgrade steps. The original disclosure predates the later CVE index entry, so the October indexing must not be presented as a newly discovered October intrusion. The original adversarial root-execution reproduction requires a separate audit of the researcher advisory.
Mechanism and trust boundary
- 01
Workflow code submission
Authenticated user with workflow creation rights supplies code to a legacy local executor.
Boundary: Tenant workflow permissions to shared workflow service container
- 02
Shared runtime access
Executed code inherits more service and database reach than the tenant UI intended.
Boundary: Workflow container process to other tenants’ data
Timeline
- Sep 7, 2026patch
Astron Agent v1.1.2 security release
Vendor documented the legacy unsandboxed workflow executor and the isolated default replacement.
Claims & evidence
CLM-AA-SCOPEThe release describes versions through v1.1.1 using local execution as affected and notes that single-tenant installations retain a code-execution risk.supported
Basis: reported finding
- supportsAstron Agent v1.1.2 security releasevendor statement
Affected versions and patched version bullets
CLM-AA-RELEASE-FIXiFlytek lists v1.1.2 as the security release, with an isolated executor by default, internal service hardening and upgrade guidance covering both service images and configuration.supported
Basis: reported finding
- supportsAstron Agent v1.1.2 security releasevendor statement
Workflow code execution and tenant isolation; Upgrade Notes
CLM-AA-EXECUTOR-IMPACTiFlytek says the legacy unsandboxed local workflow executor could let authenticated workflow creators execute code in its workflow container and access or modify other tenants’ data in affected deployments.supported
Basis: reported finding
- supportsAstron Agent v1.1.2 security releasevendor statement
Security Release, Workflow code execution and tenant isolation
Implications
The immediate boundary is between tenant-authored workflow code and the shared workflow service container. Moving code nodes into the isolated executor and applying internal service authorization blocks the vendor-described route, but updating only a front-end or leaving the legacy local executor explicitly enabled does not establish isolation.
Unknowns and contradictions
- Whether custom overrides can recreate equivalent unsafe execution after upgrading.
- Independent confirmation of the researcher’s reported root-context test and cross-tenant database operations.
- Production exploitation and number of vulnerable installations.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 123