PT-2026-66498 · Julep Ai · Julep

George Chen · CVE-2026-67348 · Publicado 2026-07-30 · Atualizado 2026-07-30

NVD

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Julep contains an insecure direct object reference vulnerability in the get execution details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary execution id values to retrieve sensitive execution records including task inputs, outputs, metadata, and temporal task tokens from other tenants.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-67348

Produtos afetados

Julep

Referências · 3

• 🔥 https://github.com/julep-ai/julep/issues/1615 · Exploit
• https://vulncheck.com/advisories/julep-insecure-direct-object-reference-via-get-executions-execution-id · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-67348 · Nota de Segurança