PT-2026-66498 · Julep Ai · Julep

George Chen · CVE-2026-67348 · Published 2026-07-30 · Updated 2026-07-30

NVD

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Julep contains an insecure direct object reference vulnerability in the get execution details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary execution id values to retrieve sensitive execution records including task inputs, outputs, metadata, and temporal task tokens from other tenants.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-67348

Affected Products

Julep

References · 3

• 🔥 https://github.com/julep-ai/julep/issues/1615 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-67348 · Security Note
• https://vulncheck.com/advisories/julep-insecure-direct-object-reference-via-get-executions-execution-id · Note