AstronRPA Cross-Tenant Shared Variable Disclosure via get-batch-shared-var
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
AstronRPA through 1.1.6 from iflytek contains a missing tenant authorization check in robot-service. An authenticated user can read other tenants' shared variables through the get-batch-shared-var endpoint by enumerating sequential shared variable IDs. Variables shared with all users are re-encrypted with the attacker's own tenant key, so the attacker can recover other tenants' credentials in plaintext. The flaw is tracked as CWE-639.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for astron-rpa.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108547
- 2026-10-11 Alias added: GHSA-mcqv-c7v8-6mw4
- 2026-10-11 Priority changed: MEDIUM → LOW
- 2026-10-18 CISA SSVC decision points changed
References
Other 4
- GitHub Issue #884
- https://github.com/iflytek/astron-rpa
- https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/robot-service/src/main/java/com/iflytek/rpa/robot/dao/SharedVarDao.xml#L52-L63
- https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/robot-service/src/main/java/com/iflytek/rpa/robot/service/impl/SharedVarServiceImpl.java#L197-L255
More iflytek vulnerabilities
- TI-2026-56868 iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check CVSS 4.0HIGH 8.6
- TI-2026-80447 Incomplete blacklist in iFlytek astron-agent DDL Whitelist handler CVSS 4.0MEDIUM 6.9
- TI-2026-74423 Cross-tenant file disclosure in iFlytek AstronRPA CVSS 4.0MEDIUM 6.0
- TI-2026-80448 Authorization bypass in iFlytek astron-agent knowledge-list endpoint CVSS 4.0MEDIUM 5.3
- TI-2026-63726 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery CVSS 4.0MEDIUM 5.3
- TI-2026-70296 Unsandboxed code node in Astron Agent enables cross-tenant RCE CVSS 3.1CRITICAL 9.9
Sources
- CVE-2026-108547 · CVE Program
- CVE-2026-108547 · NVD
- FIRST EPSS
- GHSA-mcqv-c7v8-6mw4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences