Astron-Agent (<= 1.1.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/astron-agent--1.1.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 17:45:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgiFlytek astron-agent: Incomplete blacklist in DDL Whitelist Handler (CVE-2026-116339)https://feed.craftedsignal.io/briefs/2026-10-iflytek-astron-agent-vuln/Mon, 26 Oct 2026 17:45:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-iflytek-astron-agent-vuln/A vulnerability in iFlytek astron-agent versions up to 1.1.2 allows remote attackers to manipulate the DDL Whitelist Handler via core/memory/database/api/v1/exec_ddl.py due to an incomplete blacklist implementation.CVE-2026-116339 identifies a vulnerability in iFlytek astron-agent versions up to 1.1.2. The issue exists within the DDL Whitelist Handler component, specifically in the file core/memory/database/api/v1/exec_ddl.py. An incomplete blacklist implementation allows for remote manipulation of the handler, which may facilitate unauthorized actions. The vendor has not responded to disclosure attempts, and public exploit disclosure has been observed.

Impact

The vulnerability allows for remote interaction with the DDL Whitelist Handler, potentially resulting in unauthorized DDL execution or security bypasses caused by the incomplete blacklist logic.

Recommendation

Inventory all instances of iFlytek astron-agent. As no patch is currently available from the vendor, restrict network access to the astron-agent management interfaces to trusted IP addresses only and monitor for anomalous HTTP requests targeting the DDL API endpoint.

]]>highadvisory