CVE-2026-75415: AntFlow V2.0.0 Access Control Vulnerability

CVE-2026-75415 Overview

CVE-2026-75415 is an incorrect access control vulnerability in AntFlow V2.0.0, an open-source workflow engine. The flaw resides in JiMuMDCCommonsRequestLoggingFilter.java, which retrieves the user identifier directly from an HTTP request header and treats that value as the authoritative identity for the request. Because the header is client-controlled, attackers can forge arbitrary user identity credentials and impersonate any user in the system. Successful exploitation leads to sensitive information disclosure and effective authentication bypass across endpoints protected by the filter.

Critical Impact
Unauthenticated attackers can impersonate arbitrary users by setting a single HTTP header, exposing sensitive workflow and user data.

Affected Products

AntFlow V2.0.0

Discovery Timeline

2026-08-26 - CVE-2026-75415 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75415

Vulnerability Analysis

AntFlow V2.0.0 uses JiMuMDCCommonsRequestLoggingFilter.java as part of its request processing pipeline. The filter reads a user identifier value from an incoming HTTP request header and propagates that value into the application's identity context. Downstream authorization checks then trust that identifier as if it originated from a validated session or token.

Because HTTP headers are attacker-controlled, no cryptographic material or server-side session state binds the claimed identity to the actual caller. Any client can set the header to an arbitrary user identifier and receive the privileges of that account. The design conflates request logging or tracing context with authentication, which is classified as broken access control and authentication bypass [CWE-287, CWE-284].

Root Cause

The root cause is missing authentication verification. JiMuMDCCommonsRequestLoggingFilter.java treats a header value as a trusted principal without validating it against a session, JSON Web Token, or server-side credential store. Identity assertion and identity verification are collapsed into a single client-supplied value.

Attack Vector

An attacker sends an HTTP request to a protected AntFlow endpoint and injects the user identifier header with the target user's ID. The filter accepts the value, the request executes under the impersonated identity, and the response returns data belonging to that user. No credentials, tokens, or prior session are required.

See the GitHub PoC Repository for the published proof-of-concept walkthrough.

Detection Methods for CVE-2026-75415

Indicators of Compromise

HTTP requests to AntFlow endpoints containing a user identifier header set to values that do not correspond to any authenticated session on the server.
Sequential or scripted access patterns iterating through numeric user IDs in the identity header from a single source address.
Access to sensitive workflow, approval, or user-profile endpoints without a preceding authentication request such as a login or token exchange.

Detection Strategies

Inspect web server and reverse proxy logs for the identity header on requests that lack a valid session cookie or Authorization header.
Correlate authentication events with subsequent authenticated actions and alert when the identity header appears without a matching login event.
Deploy web application firewall rules that block or flag external requests carrying the internal user-identifier header used by JiMuMDCCommonsRequestLoggingFilter.java.

Monitoring Recommendations

Enable verbose access logging on AntFlow application servers, capturing full request headers for audit review.
Baseline normal header usage and alert on header values changing frequently from the same client identifier or IP.
Monitor for spikes in access to user-scoped data endpoints from unauthenticated network paths.

How to Mitigate CVE-2026-75415

Immediate Actions Required

Restrict network exposure of AntFlow V2.0.0 to trusted internal networks until a fix is applied.
Configure the reverse proxy or ingress controller to strip the client-supplied user identifier header on all inbound requests.
Require a valid authenticated session for every endpoint that reads identity from the request context.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-75415 at the time of publication. Review the GitHub PoC Repository and the AntFlow project's upstream repository for updated releases and remediation guidance.

Workarounds

Modify JiMuMDCCommonsRequestLoggingFilter.java so it derives the user identifier from the authenticated session or validated token rather than from a request header.
Add an authentication filter that runs before the logging filter and rejects any request whose header-derived identity does not match the authenticated principal.
Enforce header sanitization at the edge by removing or overwriting the user identifier header before requests reach the application.

bash

# Example: strip the attacker-controlled identity header at an Nginx reverse proxy
location / {
    proxy_set_header  X-User-Id  "";
    proxy_pass        http://antflow-backend;
}