Julep - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/julep/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 30 Jul 2026 15:33:43 +0000Insecure Direct Object Reference Vulnerability in Julephttps://feed.craftedsignal.io/briefs/2026-07-julep-idor/Thu, 30 Jul 2026 15:33:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-julep-idor/An insecure direct object reference (IDOR) vulnerability in Julep allows authenticated tenants to bypass authorization checks and access the execution data of other tenants via the get_execution_details endpoint.Julep is affected by an insecure direct object reference (IDOR) vulnerability (CVE-2026-67348) located in the 'get_execution_details' endpoint. This flaw allows an authenticated tenant to retrieve unauthorized information by manipulating the 'execution_id' parameter. Successful exploitation grants the attacker access to sensitive data belonging to other tenants, including task inputs, outputs, execution metadata, and temporal task tokens. Given that these tokens can be used for further impersonation or unauthorized actions within the platform, this vulnerability poses a significant risk to multi-tenant cloud environments. The issue was identified and patched in commit '5371a620af2582868eb121e6489a8cc14836fd50'.

Attack Chain

  1. Attacker authenticates to the Julep platform using legitimate tenant credentials.
  2. Attacker observes network traffic while interacting with their own execution tasks.
  3. Attacker identifies the 'get_execution_details' API call structure and the associated 'execution_id' parameter.
  4. Attacker iterates or guesses 'execution_id' values belonging to other tenants.
  5. Attacker sends a crafted HTTP GET request to the 'get_execution_details' endpoint with an unauthorized 'execution_id'.
  6. The server fails to validate whether the requester owns the requested 'execution_id'.
  7. The server returns the sensitive execution records, including task inputs and temporal task tokens, to the unauthorized attacker.
  8. Attacker uses the stolen temporal task tokens to perform further actions within the context of the victim tenant.

Impact

The vulnerability results in a direct loss of confidentiality for all tenants sharing the same Julep instance. By extracting task inputs, outputs, and temporal task tokens, attackers can perform identity impersonation, data exfiltration, and potentially influence task execution logic for other users. This affects organizations relying on Julep for multi-tenant workflow orchestration.

Recommendation

  1. Upgrade Julep to commit '5371a620af2582868eb121e6489a8cc14836fd50' or later to resolve CVE-2026-67348.
  2. Review web server logs for high volumes of requests to the 'get_execution_details' endpoint containing varying 'execution_id' values from a single authenticated session.
  3. Inspect access logs for instances where a single UserID successfully retrieves data for a large number of distinct 'execution_id' records that do not align with their expected project activity.
]]>highadvisory