Which versions of Julep are affected by CVE-2026-67348?

Julep's get_execution_details API endpoint allows authenticated users in one tenant to retrieve execution records, task inputs, outputs, and metadata from other tenants, compromising multi-tenant…. A patch is available.

Is there a public PoC exploit available for CVE-2026-67348?

Yes, a public proof-of-concept exploit is available for CVE-2026-67348. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-67348?

Within 24 hours, identify all Julep instances in your infrastructure and determine whether multiple customer or business tenants share the same deployment. Within 7 days, implement compensating controls: apply network-level access restrictions to the get_execution_details endpoint using firewall rules or API gateway policies to limit connectivity to known internal service IPs, configure API rate limiting to disrupt execution ID enumeration, enable comprehensive audit logging of all execution detail requests, and conduct a forensic review of recent access logs for evidence of exploitation. Within 30 days, establish regular contact with Julep's security team regarding patch availability; upon release of a patched version, test immediately in staging and deploy to production. If no patch timeline is provided, escalate to leadership whether the risk warrants transitioning to single-tenant deployments or disabling the endpoint entirely.

Julep CVE-2026-67348

Q: What is the CVSS score of CVE-2026-67348?

CVE-2026-67348 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51151 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-30 VulnCheck

GHSA-42mr-mcg5-367r

Authentication Bypass Julep

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Any authenticated tenant (PR:L) reads across a tenant boundary, so scope changes (S:C) with high confidentiality only; read-only disclosure means I:N and A:N, unlike the input's VI:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 16:03 EUVD

Analysis Generated

Jul 30, 2026 - 15:20 vuln.today

CVE Published

Jul 30, 2026 - 14:40 cve.org

HIGH 8.6

DescriptionCVE.org

Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary execution_id values to retrieve sensitive execution records including task inputs, outputs, metadata, and temporal task tokens from other tenants.

AnalysisAI

Cross-tenant data disclosure in Julep's get_execution_details endpoint allows any authenticated tenant to read other tenants' execution records by supplying arbitrary execution_id values. Exposed data includes task inputs, outputs, metadata, and temporal task tokens, breaking multi-tenant isolation. Publicly available exploit code exists (VulnCheck-reported), though the flaw is not listed in CISA KEV - no public exploit identified as actively exploited at time of analysis.

Technical ContextAI

Julep is an AI agents/workflow orchestration platform (julep-ai:julep) that runs tenant-scoped 'executions' of tasks, backed by Temporal for durable workflow execution. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the get_execution_details endpoint uses a client-supplied execution_id as a direct object reference without verifying that the requesting tenant actually owns that execution. Because the identifier is trusted for lookup but not for authorization, tenant boundaries collapse. The leaked temporal task tokens are especially notable - these are Temporal workflow/activity identifiers that can be sensitive for interacting with or signalling running workflows, amplifying impact beyond passive data exposure.

RemediationAI

No vendor-released patch version is identified in the available data; the upstream issue (https://github.com/julep-ai/julep/issues/1615) tracks the fix, so monitor it and the VulnCheck advisory (https://www.vulncheck.com/advisories/julep-insecure-direct-object-reference-via-get-executions-execution-id) for a tagged release and upgrade as soon as one ships. As a compensating control until then, enforce tenant-scoped authorization at the get_execution_details endpoint so that execution_id lookups are filtered by the caller's tenant/developer ID (add an ownership check in the query rather than trusting the ID), which is the correct fix and has no functional side effect for legitimate users. If code changes are not immediately possible, restrict or rate-limit access to the executions API and consider gating it behind an API gateway policy that ties requests to a tenant identity, accepting that this adds request-path latency and does not fully close the gap. Additionally rotate any exposed temporal task tokens, since disclosed tokens may remain valid.