iFlytek astron-agent: Incomplete blacklist in DDL Whitelist Handler (CVE-2026-116339)

CVE-2026-116339 identifies a vulnerability in iFlytek astron-agent versions up to 1.1.2. The issue exists within the DDL Whitelist Handler component, specifically in the file core/memory/database/api/v1/exec_ddl.py. An incomplete blacklist implementation allows for remote manipulation of the handler, which may facilitate unauthorized actions. The vendor has not responded to disclosure attempts, and public exploit disclosure has been observed.

Impact

The vulnerability allows for remote interaction with the DDL Whitelist Handler, potentially resulting in unauthorized DDL execution or security bypasses caused by the incomplete blacklist logic.

Recommendation

Inventory all instances of iFlytek astron-agent. As no patch is currently available from the vendor, restrict network access to the astron-agent management interfaces to trusted IP addresses only and monitor for anomalous HTTP requests targeting the DDL API endpoint.