CVE-2026-14621
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability in the OSX Broker component of FederatedAI FATE up to version 2.2.0 causes data exposure to the wrong session due to improper handling of arguments rollSiteSessionId, dstRole, and dstPartyId in the QueuePushReqStreamObserver.initEggroll function. The attack can be executed remotely but is considered difficult due to high complexity.
Risk Assessment
The organization faces the risk of data leakage between sessions, potentially compromising the confidentiality of information processed within the FATE platform. Although the attack is difficult, it can be exploited remotely by someone with knowledge of the vulnerability details.
Recommendation
Apply the available patch from the FATE project repository as soon as it is accepted, or temporarily restrict access to the OSX Broker component to trusted networks. Monitor for a new FATE release containing the fix.
Original NVD description (English source)
A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.