Skip to content
OpenAdvisories

Vendor

iflytek

14 known vulnerabilities.

Products

astron-agent 7 astron-rpa 5 skillhub 2
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-116340

    iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization

    A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id…

    iflytek astron-agent
  • Medium 5.3
    CVE-2026-110764

    AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download

    AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable …

    iflytek astron-rpa
  • Medium 4.2
    CVE-2026-108864

    iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint

    iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict …

    iflytek astron-agent
  • Medium 6.5
    CVE-2026-108547

    AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var

    AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and de…

    iflytek astron-rpa
  • Medium 6.3
    CVE-2026-95930

    iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery

    A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side requ…

    iflytek astron-agent
  • Medium 6.3
    CVE-2026-95929

    iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection

    A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the…

    iflytek astron-agent