iFlytek astron-agent: copyFlow lacks an ownership check, letting any tenant read or overwrite workflows

Impact

astron-agent's copyFlow endpoint does not verify that the caller owns the workflow it names. Any authenticated account can enumerate workflow identifiers and either copy a private workflow to read its full definition or overwrite another tenant's workflow. Workflow definitions are where prompts, model selection, tool and API wiring, and any embedded endpoint configuration live, so reading one exposes another tenant's agent design and whatever credentials-adjacent configuration it carries. Overwriting one changes what actually executes on the fleet's inference capacity under the victim tenant's identity, and the victim gets no signal that their workflow was replaced. On a shared platform this collapses the tenant boundary in both directions with nothing more than a login.

Who can reach it

Any authenticated user of the astron-agent console, including a low-privilege tenant account. No administrative role is needed - the record states privileges are low and the identifiers are enumerable.

What to do

No fixed version exists in this record: the flaw is reported through 1.1.1 and tracked in an open upstream issue. Mitigate rather than patch - restrict console access to trusted operators, put the backend behind an authenticating proxy that scopes workflow identifiers per tenant, and treat any multi-tenant astron-agent deployment as offering no workflow isolation until upstream ships a check. If tenants genuinely do not trust each other, separate them into distinct instances.

References

Related entries

• Qdrant (`/logger`): Append to arbitrary files via the logger endpointCVE-2026-25628 · Qdrant (`/logger`)High
• llama.cpp llama-server: crafted sampler parameter triggers out-of-bounds read and unauthenticated crashCVE-2026-43628 · llama.cpp llama-server (DRY sampler, /v1/completions and /v1/chat/completions)High
• NVIDIA OpenShell Sandbox: path traversal bypasses L7 REST network policy, exposing blocked endpointsCVE-2026-65092 · NVIDIA OpenShell Sandbox for Linux (L7 REST network policy enforcement)High
• Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High
• skops (`Card.get_model`): Model card loading has no trusted-types checkCVE-2025-54886 · skops (`Card.get_model`)High
• mcp-shell: allowlist validates only the first token, so /bin/bash -c runs any commandCVE-2026-55581 · mcp-shell (security.go command allowlist, /bin/bash -c handling)High