CVE-2026-109441

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109441
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109441.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109441
Published
2026-10-20T00:46:06Z
Modified
2026-10-20T11:18:17Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridge
Details

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require_workspace_owner checks to read files such as vault secrets from exposed servers.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-653"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109441.json"
}
References

Affected packages

Git / github.com/ginlix-ai/langalpha

Affected ranges

Type
GIT
Repo
https://github.com/ginlix-ai/langalpha
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
435a5a44fabdeb33e409a62d233a936d96241c86
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "2026.09.07"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

desktop-oss-v0.*
desktop-oss-v0.2.0
desktop-oss-v0.2.1
desktop-oss-v0.2.3
desktop-v0.*
desktop-v0.2.0
desktop-v0.2.1
desktop-v0.2.3
v2026.*
v2026.04.07
v2026.04.13
v2026.04.23
v2026.04.30
v2026.06.12
v2026.06.14
v2026.06.19
v2026.06.27
v2026.07.17
v2026.07.22
v2026.07.30
v2026.08.05
v2026.09.01
v2026.09.07

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109441.json"