Security Advisory

CVE-2026-44504

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-14 15:52:30

Last updated 2026-05-16 00:38:24

Assigner GitHub_M

CVSS score 8.6

State PUBLISHED

Description

Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated attacker, given another user's thread_id, can execute graph runs against the user's thread, read the user's full checkpoint state, and inject arbitrary messages into the user's conversation history. This vulnerability is fixed in 0.9.7.

← Browse all CVEs View on cve.org ↗