Loading vulnerability…
Sandbox bypass and root code execution in Astron Agent
CVE-2026-108263 affects Astron Agent versions before 1.1.2. The default workflow code-node execution path selects LocalExecutor when CODE_EXEC_TYPE has not been explicitly changed. LocalExecutor exposes complete Python builtins during dynamic code execution rather than enforcing the documented sandbox restrictions. An authenticated, low-privilege tenant can consequently execute Python code as root in the core-workflow container and leverage shared service and database credentials to bypass application-level tenant isolation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits root-level code execution within the core-workflow container. Access to shared service and database credentials enables an attacker to bypass tenant checks, read or modify other tenants' data, and disrupt shared services. Host-level compromise or escape from the container is not established.
Patch, then assume compromise.
Upgrade Astron Agent to version 1.1.2, which fixes the vulnerability.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.