CVE-2026-108864: iFlytek Astron Agent Auth Bypass Vulnerability

CVE-2026-108864 Overview

CVE-2026-108864 is an Insecure Direct Object Reference (IDOR) vulnerability affecting iFlytek Astron Agent through version 1.1.2. The flaw resides in the POST /workflow/v1/resume endpoint, which fails to verify that the authenticated application requesting workflow resumption actually owns the referenced workflow. Any authenticated application can resume another application's paused workflow by supplying its event_id. Because event IDs are generated using the Snowflake algorithm, attackers can predict identifiers, inject resume content into victim workflows, and read the continuation output stream. This breaks cross-tenant isolation within the platform.

Critical Impact

Authenticated attackers can inject input into other tenants' workflows and exfiltrate downstream output, violating tenant isolation on the Astron Agent platform.

Affected Products

• iFlytek Astron Agent versions up to and including 1.1.2
• core/workflow/api/v1/chat/open.py resume handler
• core/workflow/cache/event_registry.py event registry component

Discovery Timeline

• 2026-10-11 - CVE-2026-108864 published to the National Vulnerability Database
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108864

Vulnerability Analysis

Astron Agent exposes a workflow resume API at POST /workflow/v1/resume that allows a paused workflow execution to be continued with supplied input. The handler accepts an event_id identifying the paused workflow but does not validate that the caller's application context matches the application that originally created the workflow. Any authenticated application in the platform can therefore resume any other application's paused workflow.

The output stream returned by the resume call includes the continuation data generated by the downstream workflow nodes. An attacker that injects resume content into a victim workflow receives the resulting output back on their own HTTP connection, enabling data disclosure beyond their tenant boundary. This weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Root Cause

The resume endpoint relies solely on the supplied event_id as the authorization key. The event registry lookup returns workflow state regardless of which application presents the identifier. Combined with Snowflake-based identifiers, which are time-ordered and partially predictable, the design permits trivial cross-application access to in-flight workflow sessions.

Attack Vector

An attacker needs a valid authenticated application token on the Astron Agent platform. They enumerate or predict Snowflake event_id values corresponding to recently paused workflows belonging to other tenants. They then issue a POST /workflow/v1/resume request supplying the target event_id and attacker-controlled continuation content. The platform resumes the victim workflow with the injected input and streams the resulting output back to the attacker.

The vulnerability mechanism is documented in the VulnCheck advisory and the HackMD cross-app workflow analysis. Reviewers can inspect the affected handler in the open chat API source and the event registry cache source.

Detection Methods for CVE-2026-108864

Indicators of Compromise

• Requests to POST /workflow/v1/resume where the authenticated application identifier does not match the owner recorded for the supplied event_id.
• High-volume or sequential enumeration of Snowflake event_id values from a single application token.
• Workflow continuation outputs delivered to an application that did not initiate the original workflow session.

Detection Strategies

• Correlate workflow creation events with resume events and alert when the originating application and resuming application differ.
• Log and inspect event_id request patterns for brute-force or predictable sequencing against the Snowflake ID structure.
• Monitor the event registry cache for lookups that cross tenant boundaries.

Monitoring Recommendations

• Enable detailed audit logging on all /workflow/v1/* endpoints, capturing application identity, event_id, and request body.
• Forward Astron Agent API logs to a centralized analytics platform for cross-tenant anomaly detection.
• Alert on 2xx responses to resume requests originating from applications with no prior workflow creation activity.

How to Mitigate CVE-2026-108864

Immediate Actions Required

• Restrict access to the Astron Agent /workflow/v1/resume endpoint at the gateway layer until a patched release is deployed.
• Audit historical resume calls and compare the caller application against the recorded workflow owner to identify prior abuse.
• Rotate application credentials that may have been used to probe cross-tenant workflows.

Patch Information

As of publication, no fixed version has been identified in the NVD record. Monitor the iFlytek Astron Agent GitHub repository for releases later than 1.1.2 that enforce ownership validation on the resume endpoint.

Workarounds

• Deploy a reverse proxy or API gateway rule that cross-references the authenticated application identifier against the event_id owner before forwarding resume requests.
• Replace predictable Snowflake-based event_id values with cryptographically random identifiers in forked or self-maintained deployments.
• Disable the resume endpoint entirely if paused-workflow functionality is not required by downstream applications.

# Example gateway deny rule pending vendor patch
# Block all external access to the vulnerable resume endpoint
location = /workflow/v1/resume {
    deny all;
    return 403;
}