CVE-2026-14621

The record

A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Affected packages

Related vulnerabilities

• CVE-2026-114637 Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the… CWE-488
• CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter… CWE-488
• CVE-2026-84685 The react-native-auth0 SDK's web platform implementation does not scope its in-memory… CWE-488
• CVE-2026-86492 In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft… CWE-488
• CVE-2026-80231 A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given… CWE-488
• CVE-2026-82367 Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can… CWE-488
• CVE-2026-71850 Hono is a Web application framework that provides support for any JavaScript runtime. CWE-488
• CVE-2026-54311 n8n is an open source workflow automation platform. CWE-488