Astron Agent Critical Flaw Allows Low-Privilege Users to Execute Code as Root

Iflytek has released version 1.1.2 of its Astron Agent platform to address a critical security vulnerability that allows authenticated users to execute arbitrary code with root privileges. The flaw, tracked as CVE-2026-108263, affects all versions of the agentic workflow platform prior to 1.1.2.

According to the National Vulnerability Database (NVD), the vulnerability carries a CVSS score of 9.9, placing it in the Critical severity category. The issue stems from the default configuration of the workflow code-node path, specifically through the endpoints `/console-api/workflow/code/run` and `/workflow/v1/run`. When the `CODE_EXEC_TYPE` variable is not explicitly changed, the system defaults to using `LocalExecutor` within the `core/workflow/engine/nodes/code/code_node.py` module.

This default `LocalExecutor` configuration supplies complete Python builtins to dynamic code execution environments. Crucially, it does this without implementing the documented sandbox restrictions that are supposed to limit execution capabilities. This lack of isolation creates a significant security gap in the platform's architecture.

Technical Context and Impact

The weakness is associated with several Common Weakness Enumerations (CWEs), including CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), CWE-306 (Missing Authentication for Critical Function), CWE-653 (Insufficient Security Engineering Process), CWE-863 (Incorrect Authorization), and CWE-1392 (Improper Restriction of Excessive Resource Consumption).

An authenticated user with low privileges can exploit this configuration to execute code as root within the core-workflow container. Once inside the container with elevated privileges, the attacker can leverage shared service and database credentials. This access allows them to bypass application-level tenant checks, which are designed to isolate data between different users or organizations using the platform.

Consequently, an attacker can read or modify data belonging to other tenants. They can also disrupt shared services, potentially causing denial-of-service conditions or other operational failures across the platform. The ability to escalate privileges from a low-privilege tenant to root access represents a severe breach of the principle of least privilege and multi-tenant isolation.

Affected Systems

The vulnerability affects Iflytek Astron Agent versions prior to 1.1.2. Astron Agent is described as an agentic workflow platform designed for building and running AI agents. Organizations deploying this platform in versions older than 1.1.2 are exposed to the risk of code execution and data exfiltration by any authenticated user, regardless of their assigned privilege level.

Iflytek has addressed the issue in version 1.1.2. The update presumably modifies the default behavior of the code execution nodes to enforce proper sandboxing or requires explicit configuration changes to enable local execution, thereby mitigating the risk of unauthorized code execution.

What should you do?

Security teams should immediately verify their current version of Astron Agent. If the deployment is running any version prior to 1.1.2, administrators should prioritize upgrading to version 1.1.2 as soon as possible.

Until the update is applied, organizations should review their access controls to limit the number of authenticated users who can interact with the code execution endpoints. Monitoring logs for unusual code execution patterns or attempts to access shared service credentials can help detect exploitation attempts.