astron-agent CVE-2026-82475

Exploitation requires a valid authenticated session on the astron-agent platform; a low-privilege account (e.g., a free-tier or trial account on a SaaS deployment) is sufficient - no administrative privileges are needed. The copyFlow endpoint must be network-accessible, which is its default purpose as a console API. The most impactful exploitation occurs in multi-tenant deployments where multiple organizations share a single astron-agent instance, as the cross-tenant access is the primary harm; single-tenant deployments where all authenticated users are trusted reduce the practical risk significantly. Exploitation is further bounded by the discoverability of valid workflow identifiers - sequential integer IDs are trivially enumerable, while random UUIDs require more effort. No special platform configuration, specific OS, or non-default feature flag is required beyond the presence of the copyFlow endpoint, which is part of the standard application.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) reflects a network-reachable, low-complexity flaw requiring only a valid low-privilege account - a realistic prerequisite on any shared or SaaS-style deployment. Both confidentiality and integrity impacts are rated High, meaning an attacker can both read sensitive workflow definitions and tamper with other tenants' production workflows. No EPSS data was provided and no CISA KEV listing exists, so widespread automated exploitation is not currently confirmed. However, public disclosure of the vulnerability details on GitHub (issue #1590) and via the VulnCheck advisory means the technical barrier to exploitation is low for anyone with a valid account. Risk is highest in multi-tenant or cloud-hosted deployments; single-tenant self-hosted instances where all users are trusted have substantially lower exposure.

An attacker registers a legitimate low-privilege account on a shared astron-agent instance, then iterates through workflow identifiers by calling the copyFlow endpoint with sequential or guessable IDs. For each valid identifier belonging to another tenant, the attacker copies the workflow into their own namespace and reads the full workflow definition - extracting proprietary AI agent logic, API keys embedded in workflow steps, or business process details - and may also overwrite a victim tenant's workflow with a modified version to disrupt their operations or inject malicious automation steps.