CVSS 4.0
8.6 highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVE-2026-44504
High (8.6). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in aegra-api 0.9.7.
Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated attacker, given another user's thread_id, can execute graph runs against the user's thread, read the user's full checkpoint state, and inject arbitrary messages into the user's conversation history. This vulnerability is fixed in 0.9.7.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-285, CWE-639
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m98r-6667-4wq7 | PyPI | aegra-api | >=0.9.0 <0.9.7 | 0.9.7 |
| PYSEC-2026-2328 | PyPI | aegra-api | >=0.9.0 <0.9.7 | 0.9.7 |