CVE-2026-82278 – BISHENG
“Workflow features can become a direct path to code execution and internal network exposure.”
BISHENG is affected by two High-severity vulnerabilities. CVE-2026-82278 allows an authenticated user to submit crafted Code nodes to the workflow run_once endpoint and execute arbitrary Python code without sandboxing, exposing the host filesystem, credentials, and internal network resources. The CVSS score is 8.8, which is High severity.
CVE-2026-82285 is an unauthenticated server-side request forgery flaw in the workflow callback endpoint. Attackers can target internal services or cloud metadata endpoints and retrieve captured responses from object storage. The CVSS score is 8.2, which is High severity. Public proof-of-concept material is available for both vulnerabilities.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-94