BISHENG CVE-2026-82278

Exploitation requires a valid BISHENG user account at any privilege level (PR:L per CVSS 4.0 vector) - administrator rights are not needed. The target must be running BISHENG before version 2.6.0. The POST /api/v1/workflow/run_once endpoint must be network-reachable by the attacker. No special deployment mode or non-default configuration is required - Code node execution via exec() is a built-in workflow feature available to all authenticated users in a standard installation. Exploitation is limited by the authentication requirement: unauthenticated remote exploitation is not possible. Attack complexity is low (AC:L) with no additional attack prerequisites (AT:N), meaning no race conditions, timing constraints, or secondary conditions must be satisfied once credentials are in hand.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately captures the network-accessible, low-complexity attack path with high impact on the vulnerable system. The PR:L metric is the key limiting factor - a valid BISHENG user account is required - however, in collaborative AI development platforms, low-privilege accounts are routinely provisioned to developers, analysts, and testers, making this barrier weaker than it may appear. EPSS data is not included in the provided intelligence, and this CVE is not listed in the CISA KEV catalog, so active exploitation is not confirmed at time of analysis. No explicit POC is cited, though the referenced GitHub issue may contain reproduction details. The CVSS 4.0 vector's SC:N/SI:N/SA:N (no subsequent system impact) may understate real-world risk: the description explicitly states that exploitation grants access to internal network resources, suggesting potential for lateral movement to adjacent systems beyond the BISHENG host. Overall, this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk paper finding - the exec() code path with no sandboxing is a direct, reliable exploitation route.

An authenticated BISHENG user crafts a workflow Code node definition containing malicious Python (e.g., a subprocess call launching a reverse shell, or os.environ extraction for API keys and database credentials) and submits it via POST /api/v1/workflow/run_once. The BISHENG backend passes the payload to exec() without sandboxing, executing the attacker's code with the privileges of the backend process. The attacker reads the host filesystem, harvests stored secrets, and uses the server's internal network position to probe or pivot to adjacent services.