CVE-2026-67348 in julep
Summary
by MITRE • 07/30/2026
Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary execution_id values to retrieve sensitive execution records including task inputs, outputs, metadata, and temporal task tokens from other tenants.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The Julep platform presents a critical insecure direct object reference vulnerability within its get_execution_details endpoint that fundamentally undermines multi-tenancy security assumptions. This flaw arises from insufficient input validation and access control mechanisms that fail to properly authenticate and authorize tenant-specific resource requests. The vulnerability specifically affects authenticated users who possess valid tenant credentials but allows them to bypass normal access controls through manipulation of the execution_id parameter.
This technical weakness stems from a direct mapping between user-supplied identifiers and internal object references without proper authorization checks. When an authenticated tenant makes a request to retrieve execution details, the system accepts the execution_id parameter directly without verifying whether the requesting tenant owns or has legitimate access to the specified execution record. The vulnerability exists in the application's data access layer where input validation occurs too late in the processing pipeline, allowing malicious actors to iterate through potential execution identifiers and extract unauthorized information.
The operational impact of this vulnerability extends beyond simple data exposure to encompass comprehensive tenant data compromise. Attackers can systematically enumerate execution records across different tenants, gaining access to sensitive task inputs that may contain confidential business data, outputs containing proprietary information, metadata describing workflow processes, and temporal task tokens that could reveal system architecture or operational patterns. This unauthorized access capability effectively eliminates the security boundaries between tenants, transforming a multi-tenant platform into a single shared environment with compromised isolation.
The vulnerability aligns with CWE-284 Access Control Issues, specifically manifesting as an improper access control mechanism that allows unauthorized access to protected resources. From an adversarial perspective, this represents a significant attack vector that could enable data theft, competitive intelligence gathering, or system reconnaissance activities. The ATT&CK framework categorizes this as privilege escalation through insecure direct object references, enabling lateral movement and information gathering within the platform's multi-tenant architecture.
Mitigation strategies must focus on implementing robust input validation and mandatory access controls at the application level. All endpoint requests should include comprehensive tenant context verification before any data retrieval occurs, utilizing proper authorization checks that validate both authentication credentials and resource ownership. The system should implement a tenant-scoped identifier approach where execution_id values are prefixed or otherwise bound to specific tenant contexts, preventing cross-tenant data access attempts. Additionally, logging and monitoring mechanisms should track unauthorized access attempts to detect potential exploitation of this vulnerability.
Security measures should also include rate limiting on execution detail requests to prevent systematic enumeration attacks, while implementing proper error handling that does not reveal whether a requested execution record exists or not. The platform architecture must enforce strict separation between tenant data stores with no direct object reference pathways that bypass authorization layers. Regular security testing and code reviews focusing on access control mechanisms should be conducted to identify similar vulnerabilities in other endpoints and prevent recurrence of such issues.
The vulnerability represents a fundamental failure in the platform's security design principles, particularly concerning the protection of multi-tenant isolation boundaries. Organizations relying on Julep should immediately implement access control fixes while conducting comprehensive audits of their entire API surface to identify additional insecure direct object reference opportunities that could similarly compromise tenant data integrity and confidentiality.