Julep
Monthly
Cross-tenant data disclosure in Julep's get_execution_details endpoint allows any authenticated tenant to read other tenants' execution records by supplying arbitrary execution_id values. Exposed data includes task inputs, outputs, metadata, and temporal task tokens, breaking multi-tenant isolation. Publicly available exploit code exists (VulnCheck-reported), though the flaw is not listed in CISA KEV - no public exploit identified as actively exploited at time of analysis.
Cross-tenant data disclosure in Julep's get_execution_details endpoint allows any authenticated tenant to read other tenants' execution records by supplying arbitrary execution_id values. Exposed data includes task inputs, outputs, metadata, and temporal task tokens, breaking multi-tenant isolation. Publicly available exploit code exists (VulnCheck-reported), though the flaw is not listed in CISA KEV - no public exploit identified as actively exploited at time of analysis.