CVE-2026-82278 | BDVDB-2026-366207 Detail

Description#

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-28Record published in the CVE List.
2. Version 22026-09-24Most recent update recorded in the CVE List.