aegra vulnerabilities

Products

• aegra 1

Latest aegra CVEs

Newest publication first

1. CVE-2026-44504 Aegra: Cross-user run injection in /threads/{thread_id}/runs (IDOR)

   Published 2026-05-14

   High·CVSS 8.6 EPSS 0.29%

   Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated attacker, given another user's thread_id, can execute graph runs against the user's thread, re...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.