CVE-2026-14621

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14621
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14621.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14621
Published
2026-07-04T08:15:08.912Z
Modified
2026-07-08T07:22:34.505595202Z
Severity
  • 1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session
Details

A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14621.json",
    "cwe_ids": [
        "CWE-488"
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/federatedai/fate

Affected ranges

Type
GIT
Repo
https://github.com/federatedai/fate
Events
Introduced
bb6de879de7d0c1f4a5a2d0d2905caf48b0861e7
Last affected
d4d8dd8557397c149634709ac319b544375ec0ae
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        },
        {
            "introduced": "2.1"
        },
        {
            "last_affected": "2.1"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "last_affected": "2.2.0"
        }
    ]
}

Affected versions

2.*
2.0
2.1
2.2.0
v2.*
v2.0.0
v2.1.0
v2.1.1
v2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14621.json"