iFlytek Astron Agent EUVD-2026-97015

Requires a valid authenticated application identity on a shared/multi-tenant Astron Agent (version ≤1.1.2) deployment, plus a victim workflow that is in the paused state awaiting resume. The attacker must supply the victim's event_id to POST /workflow/v1/resume; because these are Snowflake IDs that are time-ordered rather than cryptographically random, they are predictable/guessable, which is the core enabling condition (reflected as AT:P). Limiting factors: exploitation is impossible without authenticated access (PR:L), there must be an in-flight paused workflow to target, and single-tenant or isolated deployments eliminate the cross-tenant impact entirely.

This is a genuinely low-severity, low-priority issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 base score is only 2.3, driven by AT:P (a present attack requirement: the attacker must predict Snowflake event IDs), PR:L (a valid authenticated application identity is required), and uniformly Low impact (VC:L/VI:L, VA:N) with no subsequent-system impact (SC/SI/SA:N). No EPSS score was supplied, so exploitation probability cannot be quantified. The vulnerability is NOT on the CISA KEV list and there is no active-exploitation signal, so this is no public exploit identified at time of analysis. The practical risk ceiling is a cross-tenant confidentiality/integrity leak (reading another tenant's continuation output stream and injecting resume content), not RCE, data destruction, or full account takeover. The one caveat worth verifying: Snowflake IDs are time-ordered and only partially unpredictable, so AT:P's 'present attack requirement' may understate feasibility in a busy multi-tenant deployment where valid event_ids are easier to guess - in that case real risk trends slightly higher than the 2.3 base suggests. Overall this is a low-CVSS, low-real-risk authorization flaw that matters mainly to multi-tenant SaaS operators, not a broad emergency.

An attacker registers or already controls one authenticated application on a shared Astron Agent instance, then predicts or brute-forces a Snowflake event_id belonging to another tenant's paused workflow. By POSTing that event_id to /workflow/v1/resume, the attacker injects their own resume content into the victim's workflow and reads the victim's continuation output stream, breaking cross-tenant isolation. No weaponized public exploit was identified, though a technical write-up with source-code references exists.