CVE-2026-116340 in astron-agent
Summary
by MITRE • 10/26/2026
A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The identified vulnerability resides within iFlytek astron-agent, specifically affecting versions up to 1.1.2, and centers on the FileInfoV2Service.listKnowledgeByPage function found in the FileInfoV2.java component of the Console Knowledge-List Endpoint. This flaw represents a critical failure in access control mechanisms, allowing an attacker to bypass authorization checks through the manipulation of the space-id argument. The core technical issue stems from insufficient validation or enforcement of permissions associated with the provided identifier, enabling unauthorized entities to access sensitive knowledge base data that should be restricted to authenticated and authorized users only. This type of vulnerability is classically categorized under CWE-285, which describes Improper Authorization, where a system fails to enforce proper checks on user privileges before granting access to resources.
The operational impact of this flaw is severe due to its remote exploitability. Attackers can launch exploits from any network location without requiring prior authentication or physical proximity to the target system. The availability of public proof-of-concept code significantly lowers the barrier for entry, allowing less sophisticated threat actors to leverage existing tools rather than developing custom exploitation methods. This increases the likelihood and frequency of successful attacks against systems running vulnerable versions of the software. Compromised access could lead to unauthorized disclosure of proprietary information, intellectual property theft, or further lateral movement within an organization's network if the knowledge base contains sensitive configuration data or internal documentation.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1078, specifically Valid Accounts and potentially T1528 Steal Application Access Token, depending on how the authorization bypass is leveraged to maintain persistent access. The lack of response from the vendor upon early contact raises concerns about the timeliness of potential patches or updates. In such scenarios, organizations must rely heavily on compensating controls rather than waiting for a definitive software fix. Immediate mitigation strategies should include network segmentation to restrict access to the Console Knowledge-List Endpoint only from trusted IP ranges and implementing strict input validation rules at the web application firewall level to detect and block malformed space-id parameters that attempt to traverse authorization boundaries.
To further mitigate risk, administrators should enforce principle of least privilege by ensuring that service accounts interacting with this endpoint have minimal necessary permissions. Regular auditing of access logs for anomalous patterns related to the FileInfoV2Service can help in early detection of exploitation attempts. Until a patched version is released or vendor guidance becomes available, continuous monitoring and strict network-level controls are essential to protect against remote unauthorized access exploits targeting this specific component.