CVE-2026-116339: iFlytek astron-agent DDL whitelist bypass via comment smuggling

CVE-2026-116339 · Severity: high · CVSS 7.3 · Published 2026-10-26

iFlytek astron-agent is an agentic workflow platform with a core database service that enforces DDL (data definition language) statement restrictions. An unauthenticated attacker on the internal network can bypass these restrictions by placing an allowlisted SQL keyword in a comment, enabling execution of forbidden commands like extension installation. This grants the attacker abilities held by the database service's connection role, potentially leading to unauthorized data access or manipulation.

Technologies: iFlytek Astron-Agent. Vendors: iFlytek.

Quick answers

Is CVE-2026-116339 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116339 being exploited in the wild.
How severe is CVE-2026-116339?
High severity, with a CVSS score of 7.3, published 26 October 2026.
Which products and versions are affected?
iFlytek Astron-Agent up to 1.1.2.
Is there a fix for CVE-2026-116339?
No fixed version is recorded yet. Restrict network access to the core-database service (port 7990) to trusted internal peers only; do not expose it to untrusted networks. Run the database connection role with least-privilege permissions rather than superuser.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-116339 attacked?
It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-116339?
Check whether you run iFlytek Astron-Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict network access to the core-database service (port 7990) to trusted internal peers only; do not expose it to untrusted networks. Run the database connection role with least-privilege permissions rather than superuser.</anigation> </invoke>

Technical details

The vulnerability is a whitelist bypass (CWE-184) in the DDL validation logic of core/memory/database/api/v1/exec_ddl.py. The validator determines statement type by searching the raw SQL string for regex patterns rather than inspecting the abstract syntax tree; a comment containing "ALTER TABLE" fools the guard into accepting CREATE EXTENSION or other forbidden commands. The /xingchen-db/v1/* routers lack authentication, so any network peer reaching the service can exploit this. The service connects as a superuser role by default, amplifying the impact.

Affected products

  • iFlytek astron-agent up to 1.1.2

Timeline

  • 2026-10-26: disclosed: Public disclosure via GitHub PoC

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.