CVE-2026-44504

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44504
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44504.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44504
Aliases
Published
2026-05-14T15:52:30.547Z
Modified
2026-07-08T08:13:52.418820836Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Aegra: Cross-user run injection in /threads/{thread_id}/runs (IDOR)
Details

Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated attacker, given another user's thread_id, can execute graph runs against the user's thread, read the user's full checkpoint state, and inject arbitrary messages into the user's conversation history. This vulnerability is fixed in 0.9.7.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44504.json",
    "cwe_ids": [
        "CWE-285",
        "CWE-639"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/aegra/aegra

Affected ranges

Type
GIT
Repo
https://github.com/aegra/aegra
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bc2d538885d9315cf662282ffe81da991fc440d2
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.7"
        }
    ]
}

Affected versions

aegra-api-v0.*
aegra-api-v0.1.0
aegra-cli-v0.*
aegra-cli-v0.1.0
v0.*
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.1
v0.6.0
v0.7.0
v0.7.1
v0.7.2
v0.7.4
v0.7.5
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44504.json"