Executive brief
Julep, an AI agent platform, contains a security flaw that allows one customer to view the private task data of another. By exploiting this vulnerability, an authorized user can access sensitive information such as API keys, credentials, and personal data contained within other users' task inputs and outputs. This could lead to significant data breaches and unauthorized interference with automated business processes.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Julep `get_execution_details` endpoint (`GET /executions/{execution_id}`). In multi-tenant mode, the application fails to validate that the requested `execution_id` belongs to the authenticated `developer_id` provided in the request headers. The underlying SQL query lacks a `developer_id` predicate, allowing any authenticated tenant to retrieve sensitive execution records by supplying a target UUID. This exposure includes task inputs, outputs, metadata, and Temporal task tokens, the latter of which could be used to interfere with active executions. The vulnerability is mitigated in versions following git commit 5371a620af2582868eb121e6489a8cc14836fd50.
Affected products
- julep-ai Julep AI < 5371a620af2582868eb121e6489a8cc14836fd50 (git)
Timeline
- 2026-06-09: disclosed: Initial researcher disclosure to vendor
- 2026-07-13: other: Public issue opened on GitHub due to lack of response
- 2026-07-30: advisory: CVE published and advisory released by VulnCheck