Executive brief
FederatedAI FATE, an industrial-grade federated learning framework, contains a flaw in its OSX Broker component that can lead to data being sent to the wrong user session. By crafting specific request headers, an attacker could potentially gain access to data belonging to a different user's session. While this could lead to unauthorized data exposure, the attack is considered difficult to execute due to the high complexity required to match specific session identifiers.
Technical details
A vulnerability exists in the QueuePushReqStreamObserver.initEggroll function within the OSX Broker component of FederatedAI FATE. The root cause is an insecure session lookup mechanism that relies on a concatenated string of rollSiteSessionId, dstRole, and dstPartyId as a unique key for the Eggroll session cache. Because this key does not incorporate security-critical fields such as the request owner, tenant, or source party, a remote attacker with low privileges can craft a RollSiteHeader that collides with a victim's session key. This allows the attacker to reuse a backend session identity belonging to a different security context. A fix has been proposed in Pull Request #5792 which introduces validation of inbound party identities and scopes the session cache by task ID and RollSite context.
Affected products
- FederatedAI FATE Up to 2.2.0
Timeline
- 2026-06-01: disclosed: Issue reported on GitHub and pull request submitted
- 2026-07-04: advisory: CVE published by NVD/VulDB