iFlytek Astron Agent: workflow resume endpoint accepts another application's event_id

Impact

Astron Agent through 1.1.2 does not check that the event_id passed to POST /workflow/v1/resume belongs to the calling application, so an authenticated tenant can resume another tenant's paused workflow. Because the event ids are Snowflake values they are guessable from a known timestamp, which makes this practical rather than theoretical. The attacker both injects the resume content the victim workflow continues on - steering a human-in-the-loop step toward their own input - and reads the victim's continuation output stream, which carries model output derived from the victim's data. On a shared agent platform fronting a GPU fleet this is a direct break of cross-tenant isolation in both directions, affecting data the operator promised to keep separate.

Who can reach it

Network, authenticated as any application on the platform. No admin role and no prior access to the victim application are needed - only a guessed or observed event_id.

What to do

No fixed version is named in the record. Until the vendor publishes one, restrict reachability of /workflow/v1/resume to trusted callers at the gateway and avoid relying on Astron Agent 1.1.2 or earlier for multi-tenant workloads with data separation requirements. Any mitigation here is a gateway or deployment-topology change, not a node-level maintenance action.

References

Related entries

• vLLM: unvalidated bad_words token indices corrupt logits of other in-flight requestsCVE-2026-93989 · vLLM sampling parameters (bad_words token index validation)Low
• Langflow: authenticated user reaches eval() through component input options and runs code on the hostCVE-2026-101861 · Langflow schema.py (eval() on component input option values)Low
• vLLM: out-of-bounds read in Mamba2 mixer reachable from a completions requestCVE-2026-105775 · vLLM (Mamba2 mixer conv_ssm_forward, completions request handler)Low
• vLLM: engine crash via the penalty handler when prompt embeds are combined with penaltiesCVE-2026-105922 · vLLM (penalty handler, get_token_bin_counts_and_mask in model_executor/layers/utils.py)Low
• sherpa-onnx: unvalidated vocab_size in model metadata overflows a buffer in the transducer greedy decoderCVE-2026-108954 · sherpa-onnx OfflineTransducerGreedySearchDecoder (model-supplied vocab_size)Low
• mistral.rs: out-of-bounds read parsing GGUF token id metadata crashes the inference serverCVE-2026-75090 · mistral.rs GGUF tokenizer (convert_gguf_to_hf_tokenizer)Low