CVE-2026-108864
- Source
- https://cve.org/CVERecord?id=CVE-2026-108864
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108864.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-108864
- Published
- 2026-10-11T13:26:10Z
- Modified
- 2026-10-13T07:01:42Z
- Severity
-
- 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint
- Details
-
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-639" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108864.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108864.json
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/iflytek-astron-agent-cross-app-workflow-resume
- https://nvd.nist.gov/vuln/detail/CVE-2026-108864
- https://www.vulncheck.com/advisories/iflytek-astron-agent-through-1.1.2-authorization-bypass-via-workflow-v1-resume-endpoint
- https://github.com/iflytek/astron-agent
- https://github.com/iflytek/astron-agent/blob/v1.1.2/core/workflow/api/v1/chat/open.py#L106-L183
- https://github.com/iflytek/astron-agent/blob/v1.1.2/core/workflow/cache/event_registry.py
Affected packages
Git / github.com/iflytek/astron-agent
Affected ranges
- Type
- GIT
- Repo
- https://github.com/iflytek/astron-agent
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "last_affected": "1.1.2" }, { "fixed": "1.1.2" } ], "source": [ "AFFECTED_FIELD", "DESCRIPTION" ] }
Affected versions
Other
reward-1575
statistic-2026-09
v1.*
v1.0.0
v1.0.0-rc.2
v1.0.0-rc.3
v1.0.0-rc.4
v1.0.0-rc.5
v1.0.0-rc.6
v1.0.0-rc.7
v1.0.0-rc.8
v1.0.0-rc.9
v1.0.1
v1.0.2
v1.0.3
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108864.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "145665750332652998793170877799650921305",
"length": 989
},
"id": "CVE-2026-108864-03f27b27",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/tool/ToolBoxService.java",
"function": "createTool"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "126597179216779494238743627527458362254",
"length": 83
},
"id": "CVE-2026-108864-09a353e8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "RedirectingUrlCheckTool"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "326503463091719044608717239439393450621",
"length": 174
},
"id": "CVE-2026-108864-0ec47433",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "checkUrlRejectsLoopbackAddressDirectly"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "15798884130536393469414405158205984826",
"length": 537
},
"id": "CVE-2026-108864-1ef3e21c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "mockConfigMapper"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "238530717923839052819922733491389256568",
"length": 489
},
"id": "CVE-2026-108864-2694605c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "checkUrlAllowsIpInWhitelistCidr"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"81975688688114194541543814084977080561",
"63863479522307411188302446502181584377",
"24567577847358492394997626415475802267",
"208072094533621956219382396106006830691",
"307589644859828685477092673663660793117",
"16623288292473881620025950089387149921",
"91695140628511203270798588995827827958",
"144831227175572226178880219358802622817",
"54472981448241789959703336212930665082",
"139151761172785706097648667699954410129",
"22910007986346944048407479102611908433",
"177357907067276205982889567222819937754",
"171221367782322238196575632104635004952",
"201385842787030071714097395844882086152",
"215156793189799991435425587051228972545",
"172452296199562687451441423387548809650",
"310747080167183098425213468789311666160",
"116017365362641058797243895198681004837",
"60690285980454715141071467838388946944",
"246287949020590419675681719942118455654",
"110362639231643073741313354098179647355",
"171663891800539611363397370904896404847",
"158305037479938426187765268033472071465",
"189214927677652364317606224375121598181",
"147953237777788485327556622276800843378",
"174703843748295831691962358388774260845",
"306189632978253030515227232128590134292",
"333620531336504270782406708951822262228",
"116692014205722389585058027121392987468",
"95677316336108806348298217661817737080",
"25979799541887974214190082841829108466",
"78510886916921194344400830720871466317",
"32944111518525332874941073605551029987",
"152096744670268207115562637531437220433",
"80804085144689794336240214498310763396",
"261622949954080378364047188353599376564",
"277094832871519271676243199225164788049",
"46231614630044196296566090494739053404",
"96169357061547490442011855224540720837",
"307265057512142771035144519547133490419",
"245226537772803245233225954218993847942",
"260859218473570353584094084535757807790",
"117313298710764542941972511999210361634",
"217379307425608462148542920362229209064",
"84622196946105298222749123659634316476",
"246287949020590419675681719942118455654",
"110362639231643073741313354098179647355",
"325118520559232966712037689683172556028",
"49730715538658291953788908584469449566",
"310117531412336448725396621010796652490",
"2327115814625364027140048072634018179",
"174703843748295831691962358388774260845",
"306189632978253030515227232128590134292",
"195748401424896100856902916097277959146",
"24688829511851733395252938629051845945",
"182923050379300614307586983644503968983",
"230757234566983183410393738837427860983",
"105726705618769457933046823622194887570",
"56725694093493303040315763180376751989",
"82523725424727836128984635641311015185",
"6318615899621486748005812645116549006",
"64997653862576203876206130272557958064",
"325259346135834480064889480870659410477",
"176498373080449604905168957370130667127",
"276794883486611508023343344787264762818",
"99341122608117707903746754135863676484",
"93588397557195380623801137449011065545",
"209169100985077818962995221750291252300",
"139912601203065216238332619421270271833",
"190588149593763566764742738845820054224",
"131518706468950250626044045548132693545",
"190738950110811897329526246061365781032",
"52219928739577358939309717419923007795",
"82829236052887929778900668646081225549",
"324996897603879763275165083892321439990",
"313720410684096629098731458221972968711",
"128066121472276136825156979510941192445",
"261934766582897066533467212286219711732",
"147898363961205396676838021240888301652",
"18095555857271850628557884554714564934",
"247687986036668297615166619597503429812",
"266985043067008151812152672882991165698",
"108381463446408979170561694588957244834",
"50410735383528808512641125105668395872",
"29254334205738344032940903333676240611",
"238497696929453743875114444638913257291",
"166425198749840210494322040040801256116",
"268604650018289438100255559951027494771",
"74915486264218784709651231381162602701",
"218069866994409174638176172307182600273",
"297579609180169425197744496469910727528",
"63759363071263530283037298670852376498",
"246287949020590419675681719942118455654",
"139937307939034314418611546019209325666",
"122807687563589573524643320615600133836",
"308904415005468104016379733277488852558",
"99877675410820449541580022853095114451",
"90540653279017574282575475406507106065",
"174703843748295831691962358388774260845",
"306189632978253030515227232128590134292",
"58681086715996409864602415975133730137",
"96984530657994779770410938971914018993",
"204208056629303403065920433713685527465",
"145912265557321954670331451030841688049",
"68698389416513827470699340424371253694",
"74915486264218784709651231381162602701",
"218069866994409174638176172307182600273",
"297579609180169425197744496469910727528",
"63759363071263530283037298670852376498",
"246287949020590419675681719942118455654",
"139937307939034314418611546019209325666",
"122807687563589573524643320615600133836",
"308904415005468104016379733277488852558",
"99877675410820449541580022853095114451",
"90540653279017574282575475406507106065",
"174703843748295831691962358388774260845",
"306189632978253030515227232128590134292",
"258981234511062849596465701005285965583",
"159354468814285269276345378683527301982",
"189175604778953996746582166088666171575",
"258026590818195156140166934352346023665",
"302451645590911184904243826387788568459",
"14494473571512185851019245701561211615",
"145505869898152750544506269707222294520",
"81829789624169293564530807073125657518",
"201107550845016997724276566122766067360",
"140811424442380807283334295818486106784",
"74774685931949356973249031924505824181",
"231592459523532449642343869022759845565",
"324765520724570877574213201401794887068",
"18765060041128055189704839956753022301",
"99420899961215924788104904208486967403",
"58148734984020472590934675782476605718",
"271254454361858650526292763920465501820",
"171132232622390315882636172046323387754",
"143302401687361684079796084523756987513",
"250250881320283605376292951497925919662",
"19200105742584749689017260736428780818",
"244726533848231174615950526246151849063",
"82878444999578593033316846201361110082",
"178530491277977912501465181423966530396",
"186526295548145996980916960716826938000",
"261671130614195464268609556144204172415",
"319372783170460026747827281991360190875",
"60302428017880881172979207530234041137",
"189073756352298288912261923088939885590",
"275565651061572717164448838929036718639",
"55613574499963336691833296656328405189",
"140306171330172642737935933420349011761",
"107067623523191167839773677396193517203"
],
"threshold": 0.9
},
"id": "CVE-2026-108864-43363f5e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "21804220314210258607915181312372938221",
"length": 274
},
"id": "CVE-2026-108864-48013167",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "checkBlackListAllowsWhitelistedRedirectTarget"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "268111900866793958033659307633333114827",
"length": 352
},
"id": "CVE-2026-108864-486179fe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java",
"function": "ensurePublicAddresses"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "275538738402395520555972233416474381367",
"length": 95
},
"id": "CVE-2026-108864-4d7c0b87",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java",
"function": "getRedirectUrl"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "223419422786601128480438896203476309926",
"length": 850
},
"id": "CVE-2026-108864-6a80fd87",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java",
"function": "toSafeHttpUrl"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "303866164510011079743862219365658922973",
"length": 632
},
"id": "CVE-2026-108864-6eecb8eb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java",
"function": "lookupRedirect"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "297766944416984997966694016966562100067",
"length": 96
},
"id": "CVE-2026-108864-7142a0a1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "getRedirectUrl"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"263860677902033418556854429194812693254",
"333328150934530565641208976458353306188",
"140127397475482839019419516749058429697",
"305998154201665588088018120461128246755",
"245653901403368276794789855587035346814",
"154465915885485808395779245474741623297",
"262463231016961955469262061657308497036",
"47706522953021745609071486445367671650",
"6946641838772250710736672081112829466",
"246226040174022903033122648735910758102",
"191818115704931124277171629394960401080",
"267767980567191716142057334378382859213",
"212484849383352555558065292055159053236",
"184915155752502978961628906330477513270",
"54765729035434101038338977086526314084",
"274489476595563719410700317055583015287",
"165685608299728158309924610174248420668",
"292405002284973995943842284680004620527",
"212138697708252983388890440790476905202",
"84584118647689073807003881733315636265",
"140678207888642018494419696449151173083",
"181405523200070901375903376395587055016",
"213001126812746323685566167220660044405",
"262171634214544499639063424554679119248",
"311392454018195333658013883017191730145",
"60457831720865592665257505060354522981",
"74423578482917503914115069158025703691",
"197772845217049797778237173860304429720",
"188023328340978752977653906732307700012",
"45705853919216673892371832943121644174",
"50745507467675193553294013719116829782",
"48126738279961041076941247777749618518",
"193849083971345432231760190190082833734",
"338567888403108130228938063374949154338",
"133013864035642210876712629375722729228",
"14803668993613333750245094804473233945",
"33340652384364267564177454168631547902",
"128959664127868637998122464057179831001",
"9900276258974029383827144518480019884",
"69807771830988434628013299911167733960",
"71798994926118378882096218062523210376",
"269835777029925737057360912691514983335",
"220171381559981136866510233664146183008",
"143053449804516189368240779102524661854",
"78405177279960497400851777327805972824",
"160260748600303348913952661172292105751",
"69193165297295745780312360143926186058",
"12118618285486808566696572985251759349",
"314973288280277090856784145405285307251",
"336842694077807125722172227377545150182",
"9660540981284067006852208537491994169",
"329678151032953781115079689578775509265",
"294926345079985354426762015237965527878",
"105916010239476077331362676278524433696",
"59679650507663492047441470983716087769",
"7990841722038558893796818854825235483",
"84831254669322465853488781654582825976",
"214054025674958423181547786569081151185",
"187224478904160716661176928403794398635",
"132573215611839715800860228573076544903",
"124763034123191122393420564149772317784",
"134247417877048554738268633356559900679",
"18287965731940699644579828143460036975",
"38301674476398343121398830091954688648",
"65640200248599756457036863795718116118",
"241901632021333978663895598457099635829",
"69915431165031773644215810323204939323",
"100457837894696667177911920213190444612",
"246146295814862579996902317955711306569",
"130295460390391519080798679838539579220",
"113952984411961075456264848629144075885",
"74888321291585593021147604614204153641",
"137257209754885198734073903139699682165",
"177171659783790076948128831848233444417",
"232174714242325257918827978210391841327",
"304783664945222192737515416461902684788",
"231852748440304365651479884418583884386",
"325761864685919868398698312789069637375",
"268786227985599740231293501845104934795",
"294043371898342042165944045786360482765",
"196058572909215199685135143066334551338",
"320864965875524198016701901053335100465",
"308474953922350526742731190131666982190",
"83293885171208068613860631255184859635",
"34344569988499996922496377021689466864",
"295833350329999280972660501818934582703",
"118537745041958039160804103255492361027",
"13253527788762076848241971780135767682",
"203110925987515719593765009239690312912",
"47823658378169421411715780787327290997",
"3215882124486469798827223690294080298",
"129118024980574585429415356701108456166",
"306665369929393621782552592769766577381",
"86379700407110398620521759464657076347",
"159903854514344966012164443186666660894",
"142273427504564734376236607558870468915",
"277663852437001710649573580124799521346",
"210963435430946954244018332253402706563",
"239291391485025110904813975053116647430",
"308519479230361787330516203095702938174",
"179355192829392631475010841309021400569",
"186011953557269996002364741263472141793",
"109483554940872518957952992721195473691",
"271507752126122747826655980075102660380",
"143989127279464919172262889993271631396",
"338008409874925934417561327447380534601",
"125482329022957514383578798921009830314",
"155832567951998353007923790221638860299",
"19560453296227173561131706634256343938",
"115606733614231336174553667679798318243",
"102773042227712380051185624212894701760",
"193945555105656936453847297800470789796",
"63726031760042910161267119482571320237",
"321653962758831727714199127112185504440",
"248330914536884339228756763260008069933",
"81827248424283200364458520663716226632",
"21174487403283644896780796543649593328",
"37734627636560671549846619323047823050",
"272528562135222510337154107862913823298",
"242244596914750938247342404387186870057",
"118044608909800480775136012825459030892",
"269952751366592154579274645430434821763",
"4747899086846387166811411305799075336",
"106531076174522775130188439032945680739",
"106953895770216293800919142819581509565",
"78908914452975977528396121161132650999",
"166412856449123015810150027549615840158",
"235534376604469642762838761370020327340",
"138694288270911970590533062806488315491",
"235627931733690294982939088013258487591",
"192234659305085368215493853560810177758",
"214119543651835327535071750445603668560",
"282148136468573291582848155188504981923",
"114032053347443507204444196407255506823",
"285153623288615424554684487863511026283",
"90855974941058449301781897327878242851",
"151599960251098126888702695766446492752",
"189720023174198051225276002072950463021",
"148085761535225019602307401501954094328",
"166037665346956182651059266842197620439",
"45453829554289958593457432164095410234",
"233112983613933244229505632815017338898",
"218856526465154331651927133924719123847",
"36633759448003369931397068477492358044",
"42538362013588173681397850091656078370",
"7893423290564013452112790898715094505",
"197111086195369700993155903489517771198",
"156361199719280479078639886472524706982",
"126564546424653427991389045574167349073",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"id": "CVE-2026-108864-9d75aba6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "251080973521426746743319972162329277854",
"length": 563
},
"id": "CVE-2026-108864-a286194b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java",
"function": "isHostInDomainAllowList"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "186533484752399872693523034402703218080",
"length": 453
},
"id": "CVE-2026-108864-b3d99e54",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java",
"function": "getRedirectUrl"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "114111597420802382078254871654069219568",
"length": 1220
},
"id": "CVE-2026-108864-c2038ede",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java",
"function": "validateUrlAgainstBlacklist"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"287353381538297416521610701614398806494",
"229397462787117330021186394621938802936",
"196348343818220984012116493838734904348",
"274974913873302323687159305998652784704",
"190575059779426393250662059047423440429"
],
"threshold": 0.9
},
"id": "CVE-2026-108864-c22eaf88",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/tool/ToolBoxService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "23108364897377676709129150778518340300",
"length": 1163
},
"id": "CVE-2026-108864-c5ebf902",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/service/tool/ToolBoxServiceDebugToolTest.java",
"function": "debugToolV2_allowsTrustedOfficialInternalEndpoint"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "141339482547282822953556434350844636410",
"length": 818
},
"id": "CVE-2026-108864-d1d2d485",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java",
"function": "checkBlackList"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "251387655920364559644350374429283050065",
"length": 575
},
"id": "CVE-2026-108864-d3aa4290",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "checkUrlRejectsRedirectToNonHttpProtocol"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "218683846556497519188560801707052149512",
"length": 338
},
"id": "CVE-2026-108864-d7172bc0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "checkBlackListRejectsBlacklistedTargetAfterMultipleRedirects"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "233180121041078818150235175050098345379",
"length": 294
},
"id": "CVE-2026-108864-db3231cd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "checkBlackListRejectsRedirectTargetOutsideWhitelist"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "243994178836043636527876940537448206698",
"length": 364
},
"id": "CVE-2026-108864-e189494f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "toSafeHttpUrlPreservesEncodedPathAndQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"300149218608517874042831748984512192708",
"10337731800778357204368488913355757462",
"139408587386707792975183362803820465699",
"211604965228204844015346952538685311860",
"281860928930852196879614285514091185638",
"315990338630688082551395671320401065189",
"195464691101337472011905773264125325009",
"330127974028456938409563771413463269135",
"290688901360512166105522259329505161643",
"209475435227081942716218996000880731336"
],
"threshold": 0.9
},
"id": "CVE-2026-108864-ee403b97",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/service/tool/ToolBoxServiceDebugToolTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "249295651362983837494465859941293749502",
"length": 487
},
"id": "CVE-2026-108864-eec682ec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "checkUrlAllowsIpInWhitelist"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "221988270346357201319211781147501899958",
"length": 612
},
"id": "CVE-2026-108864-f9aa2e4a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "checkBlackListRejectsTemporaryRedirectToBlacklistedIp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "42750807705315322396678591820562307196",
"length": 257
},
"id": "CVE-2026-108864-fa29e496",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10",
"target": {
"file": "console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java",
"function": "checkUrlRejectsRedirectWithUserInfo"
}
}
]
vanir_signatures_modified
"2026-10-13T07:01:42Z"