CVE-2026-14621 Overview
CVE-2026-14621 is a vulnerability in FederatedAI FATE up to version 2.2.0 affecting the OSX Broker component. The flaw resides in the QueuePushReqStreamObserver.initEggroll function in java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java. Manipulation of the rollSiteSessionId, dstRole, or dstPartyId arguments leads to exposure of a data element to the wrong session [CWE-488]. The attack is executable remotely but carries high complexity, making exploitation difficult. The exploit has been publicly disclosed, and a pull request to remediate the issue is pending acceptance upstream.
Critical Impact
A remote attacker with low privileges can trigger cross-session data exposure in FATE's federated learning broker, potentially leaking sensitive training data between participants in a federation.
Affected Products
- FederatedAI FATE versions up to and including 2.2.0
- OSX Broker component (osx-broker)
- QueuePushReqStreamObserver gRPC stream handler
Discovery Timeline
- 2026-07-04 - CVE-2026-14621 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-14621
Vulnerability Analysis
FATE (Federated AI Technology Enabler) is an open-source federated learning framework that enables multiple parties to collaboratively train machine learning models without sharing raw data. The OSX Broker facilitates gRPC-based inter-party messaging in this architecture. The vulnerability sits in the stream initialization path where session context is bound to inbound requests.
The initEggroll method in QueuePushReqStreamObserver uses attacker-supplied values from rollSiteSessionId, dstRole, and dstPartyId to route stream payloads to backend Eggroll sessions. Because these identifiers are trusted without adequate validation, a caller can steer stream data into a session that belongs to a different logical party or role. This produces cross-tenant data exposure within the federation.
Root Cause
The root cause is classified under [CWE-488]: Exposure of Data Element to Wrong Session. The broker binds request streams to sessions using client-controlled identifiers rather than authenticated session state. When an attacker supplies crafted values, the observer initializes the Eggroll pipeline against an unintended session, mixing data flows between participants.
Attack Vector
Exploitation requires network access to the OSX Broker gRPC endpoint and a valid low-privilege authenticated context inside the federation. The attacker submits a QueuePushReq stream where the rollSiteSessionId, dstRole, and dstPartyId fields target a session belonging to another party. High attack complexity reflects the need to know or infer valid session identifiers used by other federation participants. Successful exploitation results in data intended for one session being observable or writable within another. See the GitHub Issue #5791 and the pending GitHub Pull Request #5792 for technical details on the affected code path and proposed fix.
Detection Methods for CVE-2026-14621
Indicators of Compromise
- Unexpected gRPC QueuePushReq calls where dstPartyId or dstRole values do not match the caller's expected federation membership.
- Eggroll session logs showing data writes originating from sources not associated with the session's owning party.
- Anomalous cross-party traffic patterns on the OSX Broker port between federation participants.
Detection Strategies
- Instrument the OSX Broker to log all values of rollSiteSessionId, dstRole, and dstPartyId received on initEggroll and correlate against the authenticated caller identity.
- Deploy gRPC-aware inspection to flag streams where session identifiers deviate from historical caller-to-session mappings.
- Review Eggroll session ownership records and alert on writes to sessions whose ownership does not match the originating party.
Monitoring Recommendations
- Track baseline session identifier usage per federation participant and alert on deviations.
- Monitor for elevated error rates or partial reads in Eggroll sessions that may indicate misrouted stream payloads.
- Aggregate broker access logs with participant identity data in a centralized analytics platform for cross-session correlation.
How to Mitigate CVE-2026-14621
Immediate Actions Required
- Restrict network access to the OSX Broker gRPC endpoint to authenticated federation peers only, using mutual TLS.
- Audit existing Eggroll session ownership and rotate any session identifiers that may have been exposed to untrusted peers.
- Review broker logs for anomalous dstPartyId or dstRole values inconsistent with legitimate federation topology.
Patch Information
At the time of publication no vendor-accepted patch is available. A fix has been proposed in GitHub Pull Request #5792 but remains pending acceptance. Track the upstream FATE repository and referenced advisories at VulDB CVE-2026-14621 for the official release incorporating the fix.
Workarounds
- Apply the changes from the pending pull request to local builds after independent review, validating that supplied session identifiers are cross-checked against the authenticated caller.
- Enforce mutual TLS between all federation participants so that only known peers can reach the OSX Broker.
- Segment federation participants at the network layer to limit lateral gRPC access between parties that should not directly interact.
- Increase logging verbosity on QueuePushReqStreamObserver to capture session binding decisions for forensic review.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
