LangAlpha Prompt Injection and Isolation Flaws

Indirect prompt injection in LangAlpha through 2026.09.07 allows remote attackers to run shell commands or Python inside the agent's workspace sandbox by planting instructions in web content the agent retrieves; the described payload then reads vault secrets from _internal/.vault_secrets.json. No CISA KEV entry or confirmed active exploitation is reported, and a public PoC reference exists; it is not verified as working exploit code. EPSS is 0.43% (36th percentile), the reporting source is VulnCheck, and the vuln.today priority is this_week, reflecting a real but non-emergency risk.

Cross-tenant container access in LangAlpha through 2026.09.07 allows an authenticated tenant who can execute code inside their own sandbox container to reach peer tenants' containers over Docker's shared default bridge network and read sensitive data such as vault secrets. Because inter-container communication is enabled by default and every tenant sandbox sits on that same bridge, the platform's require_workspace_owner authorization checks are effectively bypassed for traffic originating from a sibling container. Publicly available exploit code exists and the flaw is tracked as CWE-653 (Improper Isolation or Compartmentalization); exploitation requires a multi-tenant deployment, prior code execution in one's own sandbox (PR:L), and a co-tenant running an exposed, network-listening service that holds secrets, so this is best treated as a medium-priority, conditional isolation defect rather than an emergency.