Astron Agent Arbitrary Code Execution Vulnerability Breaks Tenant Isolation in Pre-1.1.2 Builds

A critical remote code execution vulnerability in the Astron Agent platform allows authenticated low-privilege tenants to execute code with root privileges. The flaw stems from the default configuration of the workflow code-node, which fails to enforce sandbox restrictions on dynamic Python execution.

Root cause

The vulnerability originates in the `core/workflow/engine/nodes/code/code_node.py` file. When the `CODE_EXEC_TYPE` parameter is not explicitly modified, the system defaults to using `LocalExecutor`. This component provides complete Python builtins to the execution environment, ignoring documented sandbox limitations. According to the NVD record, this configuration exposes the underlying system to unrestricted code execution.

Attack path

An authenticated user with low privileges can exploit the `/console-api/workflow/code/run` and `/workflow/v1/run` endpoints. By submitting malicious code through these paths, the attacker gains root access within the core-workflow container. From this privileged position, the attacker can access shared service and database credentials, bypassing application-level tenant checks to read or modify data belonging to other tenants.

Affected versions

• Astron Agent versions prior to 1.1.2 are affected.
• The vendor has released version 1.1.2, which fixes this issue.
• Users running older builds remain exposed to this critical flaw.

Mitigation

• Upgrade Astron Agent to version 1.1.2 immediately.
• Review access logs for suspicious code execution requests.
• Isolate containers to limit lateral movement potential.

What to do and how to stay safe: Astron Agent

• Verify if your environment uses Astron Agent versions earlier than 1.1.2.
• Monitor container logs for unexpected Python script executions or root-level commands.
• Ensure tenant isolation controls are enforced at the infrastructure level, not just the application layer.
• Restrict network access between workflow containers and shared database services.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-108263?

The NVD rates CVE-2026-108263 as Critical with a CVSS score of 9.9.

Which versions of Astron Agent are vulnerable?

All versions of Astron Agent prior to 1.1.2 are affected by this vulnerability.

How can an attacker exploit this flaw?

An authenticated tenant can execute arbitrary Python code as root via the default LocalExecutor, allowing them to access shared credentials and bypass tenant isolation.