Is CVE-2026-108864 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108864 being exploited in the wild.

How severe is CVE-2026-108864?

Medium severity, with a CVSS score of 4.2, published 11 October 2026.

Which products and versions are affected?

iFlytek Astron-Agent through 1.1.2.

Is there a fix for CVE-2026-108864?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108864 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-108864?

Check whether you run iFlytek Astron-Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108864: iFlytek Astron Agent insecure direct object reference in workflow resume

CVE-2026-108864 · Severity: medium · CVSS 4.2 · Published 2026-10-11

iFlytek Astron Agent is an enterprise workflow automation platform that orchestrates multi-agent tasks. An authenticated attacker can resume other tenants' paused workflows by guessing predictable event IDs and inject content into victim workflows, allowing them to read sensitive output data and bypass tenant isolation. This breaks the security boundary between customers in shared deployments.

Technologies: iFlytek Astron-Agent. Vendors: iFlytek.

Quick answers

Is CVE-2026-108864 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108864 being exploited in the wild.
How severe is CVE-2026-108864?: Medium severity, with a CVSS score of 4.2, published 11 October 2026.
Which products and versions are affected?: iFlytek Astron-Agent through 1.1.2.
Is there a fix for CVE-2026-108864?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108864 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-108864?: Check whether you run iFlytek Astron-Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The POST /workflow/v1/resume endpoint performs insecure direct object reference (IDOR) validation, checking only that the requester is authenticated but not that they own the event_id being resumed. Because Snowflake event IDs are predictable, an attacker can brute-force valid IDs from other tenants, resume their paused workflows, and exfiltrate continuation output. The vulnerability requires prior authentication and network access to the API.

Affected products

iFlytek Astron Agent through 1.1.2

Timeline

2026-10-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.