p PatchFirst

PatchFirst · Latest vulnerabilities

aegra-api vulnerabilities

Vulnerabilities published for aegra-api in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-44504

    High · CVSS 8.6EPSS 0.29%Fix available

    Aegra: Cross-user run injection in /threads/{thread_id}/runs (IDOR)

    Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated attacker, given another user's thread_id, can execute graph runs against the user's thread, read the user's full checkpoint state, and inject arbitrary messages into the user's conversation history. This vulnerability is fixed in 0.9.7.

    aegra-apiPython
    • Update to 0.9.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →