CVE-2026-109441: LangAlpha 0 through 2026.09.07

Affected technology

LangAlpha · 0 through 2026.09.07
ginlix-ai

Description’s affected range: through 2026.09.07

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

Authenticated users with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require_workspace_owner checks to read files such as vault secrets from exposed servers. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as high; integrity and availability impact as none.