CVE-2026-108547 iflytek CVE debrief

Who should care

Defenders and administrators of AstronRPA deployments, especially in multi-tenant environments, should assess exposure and prioritize remediation. This includes reviewing and implementing proper tenant authorization checks, restricting access to the get-batch-shared-var endpoint, and verifying the existence of affected product deployments in managed environments.

Why it matters

CVE-2026-108547 is a high-severity vulnerability in AstronRPA that allows authenticated users to read other tenants' shared variables due to a missing tenant authorization check. Defenders should prioritize verifying and remediating this vulnerability in AstronRPA deployments, especially in multi-tenant environments, to prevent potential unauthorized access to sensitive data and lateral movement.

• Potential unauthorized access to sensitive data
• Possible lateral movement within multi-tenant environments
• Required verification of AstronRPA deployments for vulnerability exposure
• Necessity for implementing proper tenant authorization checks

Technical summary

The vulnerability exists in the robot-service of AstronRPA, specifically in the get-batch-shared-var endpoint, where a missing tenant authorization check allows authenticated users to read other tenants' shared variables. This could lead to unauthorized access to sensitive data and potential lateral movement within multi-tenant environments. The affected product is AstronRPA version 1.1.6 and potentially earlier versions. Defenders should prioritize verifying and remediating this vulnerability in AstronRPA deployments, especially in multi-tenant environments.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in AstronRPA deployments, especially in multi-tenant environments.

Recommended defensive actions

• Verify and remediate AstronRPA deployments, especially in multi-tenant environments
• Restrict access to the get-batch-shared-var endpoint
• Implement proper tenant authorization checks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references indicate a missing tenant authorization check in AstronRPA's robot-service, allowing authenticated users to read other tenants' shared variables. The vulnerability has been confirmed to exist in AstronRPA version 1.1.6 and may affect earlier versions. Defenders should verify the existence of affected product deployments in managed environments and review official advisories for further guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.