Cross-Tenant IDOR Vulnerability in Aegra for Multi-User Deployments

CVE-2026-44504

What is CVE-2026-44504?

A vulnerability exists in Aegra, a solution used for LangSmith Deployments, prior to version 0.9.7. This flaw allows multiple authenticated users on a shared instance to exploit cross-tenant scenarios. An attacker, with knowledge of another user's thread_id, can perform unauthorized actions such as executing graph runs on that user's thread, accessing their complete checkpoint state, and injecting arbitrary messages into their conversation history. This poses a significant risk to user data privacy and integrity. The issue has been addressed in version 0.9.7, and it is essential for users to update to this version to mitigate any potential exploitation.

References