Key points
- CVE-2026-96679 allows unauthenticated account takeover and super-admin privilege escalation.
- CVE-2026-96681 enables authenticated users to read other users' workflow configurations.
- Patches exist for two flaws, but the SSO bypass remains unpatched by the vendor.
CERT/CC published advisory VU#166125 detailing three vulnerabilities in Bisheng, an open-source large language model application DevOps platform developed by DataElement. The report highlights that unauthenticated attackers can achieve full administrative control, while authenticated users can access sensitive cross-user data and credentials.
The most severe issue, CVE-2026-96679, resides in a legacy single sign-on endpoint. The application issues valid JSON Web Tokens for arbitrary usernames without verifying caller authentication. If the username does not exist, the system registers it automatically, granting super-administrator privileges if it matches the configured admin name or is the first user.
Context and Background
CVE-2026-96681 is an insecure direct object reference flaw affecting version retrieval endpoints. The source code retrieves workflow version records based on user-supplied parameters without validating data ownership. Any authenticated user can query and read complete domain-specific language configurations belonging to other accounts, breaching data confidentiality.
Who Is Affected
CVE-2026-100156 affects versions prior to 2.5.0. It allows authenticated attackers to perform cross-user large language model credential abuse. The assistant service accepts identifiers without verifying ownership, enabling unauthorized AI inferences billed to other users' provider accounts and leaking configured tools and workflows.
Next steps
DataElement has remediated CVE-2026-100156 in version 2.5.0 and CVE-2026-96681 in version 3.0.0. However, the vendor has not responded to coordination efforts regarding CVE-2026-96679. CERT/CC recommends upgrading to patched releases where possible and implementing manual mitigations for the remaining unpatched SSO vulnerability until an official update becomes available.
Signals worth monitoring
Teams usually check authentication logs for unexpected JSON Web Token issuances from the legacy single sign-on endpoint, particularly those associated with new user registrations or administrative privilege escalations. Security operations centers should monitor for anomalous access patterns where authenticated users retrieve workflow configurations or domain-specific language records belonging to other accounts.
Analysts often look for unusual API calls to assistant service endpoints that do not match the caller's ownership profile. Initial containment moves typically involve disabling the vulnerable legacy endpoint or enforcing strict network allowlisting to prevent external exploitation.
What to do and how to stay safe: Bisheng
- Review Bisheng environment configurations to ensure the legacy single sign-on endpoint is disabled or deprecated.
- Verify that global JSON Web Token validation is enforced across all authentication mechanisms.
- Audit user accounts for any unexpected administrative privileges or new registrations originating from the SSO endpoint.
- Upgrade Bisheng installations to version 3.0.0 to patch the IDOR and credential abuse vulnerabilities.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Bisheng versions are affected by the credential abuse flaw?
Versions prior to 2.5.0 are affected by CVE-2026-100156, which allows authenticated attackers to abuse cross-user LLM credentials.
Is there a patch for the legacy SSO bypass?
No, DataElement has not responded to coordination efforts regarding CVE-2026-96679, so no official patch exists yet.
How does the IDOR vulnerability expose data?
CVE-2026-96681 allows authenticated users to retrieve workflow version records without permission validation, exposing other users' DSL configurations.
