Tools AI Risk Radar ai-incident-0209
Incident record
AstronRPA gateway accepts unverified bearer tokens
- Severity
- High
- Status
- Research
- Type
- Infra Vuln
- Target
- AstronRPA through 1.1.6
- Actor
- researcher
- CVE
- CVE-2026-108548
What happened
The gateway’s bearer-token handler can let requests reach resource and AI-service routes without validating the supplied token.
The public issue and proposed fix appeared on 6 October; the CVE was published on 10 October. The CNA gives CVSS 3.1 score 7.3. The fix in pull request 887 remained open and unmerged when checked on 11 October.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-108548
- Public researcher issuegithub.com/iflytek/astron-rpa/issues/886
- Proposed gateway fixgithub.com/iflytek/astron-rpa/pull/887
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026