CVE-2026-108263: Astron Agent: Unsandboxed code-node leads to cross-tenant RCE
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/codenode.py when CODEEXECTYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Astron Agentto a version that resolves this vulnerability.Fixed in 1.1.2
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated low-privilege tenant can exploit it. No user interaction is required, and the affected code execution endpoint is reachable over the network.
Are default deployments affected?
Yes. Before version 1.1.2, the default code-node configuration selects LocalExecutor when CODE_EXEC_TYPE has not been explicitly changed, exposing dynamic code execution with complete Python builtins.
What is the practical impact in a shared deployment?
Code can execute as root in the core-workflow container. An attacker can use shared service and database credentials to bypass tenant-level application checks, access or alter other tenants' data, and disrupt shared services.
What should teams do if they cannot upgrade immediately?
Explicitly change CODE_EXEC_TYPE so the default LocalExecutor path is not used. Upgrading to version 1.1.2 is the documented fix.
How can I determine whether my deployment is exposed?
Deployments running a version before 1.1.2 are exposed if workflow code nodes can be run through /console-api/workflow/code/run or /workflow/v1/run and CODE_EXEC_TYPE has not been explicitly changed from the default selection behavior.