CVE-2026-108547: AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-10 · updated 2026-10-18
Weakness: CWE-639

Description

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.

Affected products

iflytek astron-rpa: through 1.1.6

References

https://github.com/iflytek/astron-rpa
https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/robot-service/src/main/java/com/iflytek/rpa/robot/dao/SharedVarDao.xml#L52-L63
https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/robot-service/src/main/java/com/iflytek/rpa/robot/service/impl/SharedVarServiceImpl.java#L197-L255
https://github.com/iflytek/astron-rpa/issues/884
https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-cross-tenant-shared-variable-disclosure-via-get-batch-shared-var

Get alerted when CVE-2026-108547 or the next vulnerability affects your stack