LangAlpha CVE-2026-109441

Requires a multi-tenant LangAlpha deployment where each tenant's sandbox runs as a Docker container on the default bridge network with inter-container communication (ICC) enabled - Docker's default behavior, so this is not a setting the operator must opt into. The attacker must be an authenticated tenant able to execute code inside their own sandbox (PR:L), and a victim tenant must concurrently run an exposed, network-listening server in its container that holds secrets (the AT:P/UI:P target-present condition). Exploitation is LIMITED by: mandatory authentication, the need to already achieve code execution in one's own sandbox, the requirement that a co-tenant have an exposed service running at the time of attack, and the discovery/timing effort of locating peer containers (AC:H). Deployments that isolate tenants on per-tenant Docker networks, disable ICC, or run single-tenant are not exposed.

This is a genuine but conditional multi-tenant isolation flaw, best treated as a medium-priority issue rather than a drop-everything emergency. The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P) scores 6.9 and tells a consistent story: a network-reachable attack that nonetheless requires authenticated access (PR:L), high complexity (AC:H), a present/active target condition (AT:P), and victim-side interaction (UI:P), with impact limited to confidentiality on both the vulnerable and a subsequent system (VC:H/SC:H; VI/VA/SI/SA:N). Public exploit code exists (reported by VulnCheck, with a Lasso Security write-up), which raises practical risk, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - publicly available exploit code must not be conflated with in-the-wild use. Real-world risk is gated hard by preconditions: the attacker must already be an authenticated tenant able to run code in their own sandbox, and a co-located victim tenant must run an exposed server holding secrets. The signals are broadly consistent (no conflict between the 'network' vector and the authenticated/code-execution precondition, since the hop is container-to-container over the shared Docker bridge). The dominant mitigating reality is deployment footprint: LangAlpha is a niche open-source AI agent project, so this is a high-quality vulnerability in a low-prevalence product.

A paying or trial tenant on a shared LangAlpha instance runs attacker code inside their own sandbox container, then uses it to reach across Docker's default bridge network to another tenant's container listening on an internal service. Because inter-container communication is enabled and require_workspace_owner checks are bypassed at the network layer, the attacker reads that tenant's exposed files - including vault secrets. Public exploit code is available, lowering the skill barrier, though success depends on a victim tenant actively running an exposed server.