CVE-2026-109441
Deferred Deferred - Pending Action

Improper Network Isolation in LangAlpha Sandbox Containers

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require_workspace_owner checks to read files such as vault secrets from exposed servers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-07
NVD
CVE-2026-109441
EUVD
EUVD-2026-104681

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ginlix-ai LangAlpha 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-653 The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LangAlpha through 2026.09.07 has an improper isolation flaw where all tenants' sandbox containers share Docker's default bridge network with inter-container communication enabled. Authenticated users with code execution in their sandbox can directly connect to other tenants' containers, bypassing workspace owner checks to access sensitive files like vault secrets.

Detection Guidance

Check if LangAlpha instances are using Docker's default bridge network by running 'docker network inspect bridge'. Verify if multiple tenants' containers share this network with inter-container communication enabled. Inspect sandbox configurations in core.py for network isolation settings.

Impact Analysis

If you use LangAlpha, an attacker with access to your sandbox could exploit this to read files from other tenants' containers, potentially stealing sensitive data such as secrets or confidential information. This could lead to data breaches, unauthorized access, or compliance violations depending on the exposed data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using LangAlpha may face compliance failures, legal penalties, or reputational damage if tenant data is exposed.

Mitigation Strategies

Upgrade LangAlpha to a version beyond 2026.09.07. Configure Docker to use user-defined bridge networks for sandbox isolation. Disable inter-container communication on the default bridge network using 'docker network update --internal bridge'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109441. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...