These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE-2026-108864 vulnerability in iFlytek Astron Agent through version 1.1.2 allows authenticated applications to resume other applications' paused workflows by supplying their event_id to the POST /workflow/v1/resume endpoint. This insecure direct object reference vulnerability can be exploited to inject resume content into victim workflows and read their continuation output stream, potentially breaki [truncated]
CVE-2026-108550 is an incorrect authorization vulnerability in SkillHub before version 0.2.22, allowing authenticated attackers to take over other accounts by abusing the merge flow. This vulnerability is located in SkillHub's AccountMergeService and AccountMergeController, enabling attackers to inherit API tokens, roles, and namespace ownership. Defenders should prioritize verifying exposure of SkillHub [truncated]
CVE-2026-108548 is an authentication bypass vulnerability in AstronRPA through version 1.1.6. The OpenResty gateway's auth_handler.lua accepts any Bearer token without validation, allowing unauthenticated attackers to access /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user. This vulnerability allows attackers to bypass authentication and potentially [truncated]
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. This vulnerability exists in multi-tenant environments, potentially allowing lateral movement and unauthorized access to sensitive data. Defenders should prioritize verifying and remediating this vulnerability [truncated]
Astron Agent, an agentic workflow platform, had a critical vulnerability prior to version 1.1.2. An authenticated low-privilege tenant could execute code as root in the core-workflow container due to unsandboxed code-node execution. This allowed for cross-tenant RCE, enabling the reading or modification of other tenants' data and disruption of shared services. The issue was fixed in version 1.1.2.
A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is possible to launch the attack remotely. Upgrading to version reward-1575 is able to address [truncated]
The iFlytek astron-agent through version 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint. This vulnerability allows authenticated attackers to enumerate workflow identifiers and potentially overwrite other tenants' workflows or copy private workflows to read their definitions. Users of iFlytek astron-agent should be aware of this vulnerability and take steps to mitigate it, i [truncated]