What happened
Published Aug 29, 2026 with CVSS 8.1/8.6 (High). astron-agent is iFlytek's multi-tenant agentic AI workflow platform; the flaw lets any authenticated user tamper with or exfiltrate other customers' agent workflow definitions.
Why it matters
In a multi-tenant agent-building platform, workflow definitions often encode business logic, embedded credentials, and proprietary prompts/tool configurations. Cross-tenant overwrite also enables supply-chain-style sabotage — an attacker can silently replace another tenant's agent workflow with a malicious one that executes under that tenant's identity and permissions.
Attack vector
The copyFlow endpoint in iFlytek's astron-agent platform fails to validate workflow ownership. An authenticated attacker can enumerate workflow identifiers belonging to other tenants and either overwrite their agent workflows or copy private workflows to read their definitions — no ownership check is enforced.
Affected systems
iflytek/astron-agent through 1.1.1
Mitigation
Apply vendor patch when available; enforce server-side ownership/tenant validation on all workflow-copy and workflow-modification endpoints; audit workflow access logs for cross-tenant enumeration patterns.