Is CVE-2026-108864 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108864?

CVE-2026-108864 has a CVSS v3 severity of MEDIUM (4.2).

Back

CVE-2026-108864

Description

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation.