{"id":"CVE-2026-116339","kind":"vulnerability","aliases":["CVE-2026-116339"],"related":[],"title":"iFlytek astron-agent: incomplete SQL blacklist lets remote requests run DDL","description":"A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The DDL validation in astron-agent's memory database API (core/memory/database/api/v1/exec_ddl.py) relies on an incomplete reserved-keyword blacklist, so crafted DDL can get past it. Affects self-hosted deployments where the exec_ddl endpoint is reachable by untrusted callers; auth requirement is not confirmed in any primary source. Deployments with the core database service on an internal network and no untrusted tenants are least exposed.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"astron-agent","fixed":[],"affected":"<= 1.1.2 (unconfirmed)","ecosystem":"github"}],"ecosystems":[],"tags":["ai-agent-platform","ai-tooling","astron-agent","self-hosted","sql-injection"],"not_affected_if":["api-not-exposed","version-above-1.1.2"],"how_to_check":"Check installed astron-agent version (<= 1.1.2 presumed affected, unconfirmed). Check whether the core-database service (exec_ddl route) is reachable from untrusted networks or from tenants who can build workflows. Review ALLOWED_DDL_STATEMENTS and PGSQL_INVALID_KEY logic in exec_ddl.py.","fix":"unknown: no patched version published for this CVE as far as found; v1.1.2 does not document a fix for it. Watch iflytek/astron-agent releases and commits touching core/memory/database/api/v1/exec_ddl.py.","status":"open","published_at":"2026-10-26T15:16:39+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","triaged_at":"2026-10-26T16:03:46+00:00","updated_at":"2026-10-26T16:05:28+00:00","category":"ai-tooling","confidence":0.4,"triage":{"at":"2026-10-26T16:03:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"iFlytek astron-agent: incomplete SQL blacklist lets remote requests run DDL","impact":"high","summary":"The DDL whitelist handler in astron-agent's memory database API (core/memory/database/api/v1/exec_ddl.py) uses an incomplete blacklist, so crafted input can get past it. A remote attacker can use this to run schema-altering SQL against the database the agent connects to.","category":"ai-tooling","nicknames":[],"who_cares":["astron-agent","self-hosted","ai-agent-platform"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker alters database schema through unrestricted DDL statements","analyst_note":"Find a vendor fix or patched version and confirm the exact trigger and auth requirement; check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116339) and the astron-agent repository for the referenced exploit and commit.","how_to_check":"- Check whether the installed astron-agent is version `1.1.2` or earlier.\n- Look for the file `core/memory/database/api/v1/exec_ddl.py` in the deployment and review its DDL whitelist/blacklist logic.\n- Check whether the memory database API endpoint that calls `exec_ddl.py` is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["version-above-1.1.2","api-not-exposed"],"who_is_affected":"Teams that run iFlytek astron-agent 1.1.2 or earlier with its memory database API reachable over the network are exposed. The sources do not say whether the vendor released a fix, and the vendor did not respond to early disclosure. Deployments not running this version, or not exposing the memory database API, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001025,"input_tokens":3354,"output_tokens":1380,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find a vendor fix or patched version and confirm the exact trigger and auth requirement; check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116339) and the astron-agent repository for the referenced exploit and commit.","search":"'-116339':15A,18A '-2026':14A,17A '1.1.2':117C 'affect':65B,119C 'agent':4A,21A,24B,31B,44B,114C 'ai':23B,27B 'ai-agent-platform':22B 'ai-tool':26B 'api':48B 'astron':3A,20A,30B,43B,113C 'astron-ag':2A,29B,42B,112C 'astron-agent':19A 'attack':139C 'auth':80B 'blacklist':7A,57B,137C 'caller':79B 'caus':135C 'compon':129C 'confirm':84B 'contact':157C 'core':92B 'core/memory/database/api/v1/exec_ddl.py':49B,126C 'craft':59B 'cve':13A,16A 'databas':47B,93B 'ddl':12A,39B,60B,73B,130C 'deploy':69B,89B 'determin':109C 'disclos':149C 'disclosur':161C 'earli':158C 'endpoint':74B 'exec':72B 'exploit':145C 'expos':105B 'file':125C 'function':122C 'get':62B 'handler':132C 'host':34B,68B 'iflytek':1A,111C 'incomplet':5A,53B,136C 'initi':142C 'inject':37B 'intern':97B 'keyword':56B 'least':104B 'let':8A 'manipul':134C 'may':140C,151C 'memori':46B 'network':98B 'past':63B 'platform':25B 'primari':87B 'public':148C 'reachabl':76B 'reli':50B 'remot':9A,143C 'request':10A 'requir':81B 'reserv':55B 'reserved-keyword':54B 'respond':165C 'run':11A 'self':33B,67B 'self-host':32B,66B 'servic':94B 'sourc':88B 'sql':6A,36B 'sql-inject':35B 'tenant':102B 'tool':28B 'unknown':121C 'untrust':78B,101B 'util':153C 'valid':40B 'vendor':155C 'vulner':107C 'way':168C 'whitelist':131C","nicknames":[],"mitigations":[],"who_affected":"Teams that run iFlytek astron-agent 1.1.2 or earlier with its memory database API reachable over the network are exposed. The sources do not say whether the vendor released a fix, and the vendor did not respond to early disclosure. Deployments not running this version, or not exposing the memory database API, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116339","severity":null,"published_at":"2026-10-26T15:16:39+00:00","modified_at":"2026-10-26T15:16:39+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","fetched_at":"2026-10-26T16:02:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116339:835","url":null,"severity":null,"published_at":"2026-10-26T16:05:28+00:00","modified_at":"2026-10-26T16:05:28+00:00","first_seen_at":"2026-10-26T16:05:28+00:00","fetched_at":"2026-10-26T16:05:28+00:00","note":"No vendor advisory, fix commit or patched version found for this CVE; NVD page returned empty. Affected range 'through 1.1.2' comes from triage only. v1.1.2 security release covers other issues (code-node RCE), not this. exec_ddl.py source and PR #969 (added the keyword blacklist; reviewer flagged incomplete identifier collection) linked as context. Auth requirement unconfirmed. Nothing marked verified."}],"documents":[{"id":3944,"url":"https://github.com/iflytek/astron-agent/blob/2e1863c7/core/memory/database/api/v1/exec_ddl.py","title":"astron-agent core/memory/database/api/v1/exec_ddl.py (2e1863c7)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3945,"url":"https://github.com/iflytek/astron-agent/pull/969","title":"PR #969 database project add dangerous function detection (review flags incomplete identifier collection)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}