---
id: "CVE-2026-116339"
kind: "vulnerability"
aliases: ["CVE-2026-116339"]
title: "iFlytek astron-agent: incomplete SQL blacklist lets remote requests run DDL"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "astron-agent", "fixed": [], "affected": "<= 1.1.2 (unconfirmed)", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-agent-platform", "ai-tooling", "astron-agent", "self-hosted", "sql-injection"]
not_affected_if: ["api-not-exposed", "version-above-1.1.2"]
published_at: "2026-10-26T15:16:39+00:00"
first_seen_at: "2026-10-26T16:02:25+00:00"
updated_at: "2026-10-26T16:05:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116339", "first_seen_at": "2026-10-26T16:02:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T16:05:28+00:00"}]
---

# iFlytek astron-agent: incomplete SQL blacklist lets remote requests run DDL

The DDL validation in astron-agent's memory database API (core/memory/database/api/v1/exec_ddl.py) relies on an incomplete reserved-keyword blacklist, so crafted DDL can get past it. Affects self-hosted deployments where the exec_ddl endpoint is reachable by untrusted callers; auth requirement is not confirmed in any primary source. Deployments with the core database service on an internal network and no untrusted tenants are least exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:astron-agent affected <= 1.1.2 (unconfirmed) fixed ?

## How to check

Check installed astron-agent version (<= 1.1.2 presumed affected, unconfirmed). Check whether the core-database service (exec_ddl route) is reachable from untrusted networks or from tenants who can build workflows. Review ALLOWED_DDL_STATEMENTS and PGSQL_INVALID_KEY logic in exec_ddl.py.

## Fix

unknown: no patched version published for this CVE as far as found; v1.1.2 does not document a fix for it. Watch iflytek/astron-agent releases and commits touching core/memory/database/api/v1/exec_ddl.py.

## Timeline

- 2026-10-26T16:02:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116339
- 2026-10-26T16:05:28+00:00 analyst — No vendor advisory, fix commit or patched version found for this CVE; NVD page returned empty. Affected range 'through 1.1.2' comes from triage only. v1.1.2 security release covers other issues (code-node RCE), not this. exec_ddl.py source and PR #969 (added the keyword blacklist; reviewer flagged incomplete identifier collection) linked as context. Auth requirement unconfirmed. Nothing marked verified.

## Documents

- [describes] astron-agent core/memory/database/api/v1/exec_ddl.py (2e1863c7) https://github.com/iflytek/astron-agent/blob/2e1863c7/core/memory/database/api/v1/exec_ddl.py
- [mentions] PR #969 database project add dangerous function detection (review flags incomplete identifier collection) https://github.com/iflytek/astron-agent/pull/969

## From the sources

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_