Description
A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Published: 2026-07-04
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the QueuePushReqStreamObserver.initEggroll routine of the OSX Broker component in FederatedAI FATE allows an attacker to manipulate the dstRole and dstPartyId parameters, causing data elements to be exposed to unintended sessions. This session-handling weakness (CWE-488) can lead to confidential data leaking between parties that should not share that data.

Affected Systems

The vulnerability affects deployments of FederatedAI FATE up to and including version 2.2.0 where the OSX Broker component is in use. The affected component is the QueuePushReqStreamObserver in the OSX Broker.

Risk and Exploitability

The CVSS score of 2.3 places this flaw in the low severity range, and the EPSS score is less than 1%, indicating that the likelihood of widespread exploitation is currently low. The flaw is not listed in any current KEV catalog. The exploit is remote, requiring manipulation of the rollSiteSessionId, dstRole, and dstPartyId parameters; while the attack has high complexity and is considered difficult, a remote attacker who can reach the OSX Broker endpoint could potentially manipulate session identifiers and expose data elements to an unintended session.

Generated by OpenCVE AI on July 31, 2026 at 14:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the FederatedAI FATE patch once the pull request is merged, or upgrade to a release that includes the fix, such as 2.2.1 or later.
  • Restrict external access to the OSX Broker component with firewall rules or network segmentation to reduce the attack surface and prevent remote manipulation of session identifiers.
  • Implement strict input validation for rollSiteSessionId, dstRole, and dstPartyId to ensure that only intended session identifiers are accepted by the QueuePushReqStreamObserver endpoint, and monitor for anomalous session ID usage.

Generated by OpenCVE AI on July 31, 2026 at 14:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Title FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session
First Time appeared Federatedai
Federatedai fate
Weaknesses CWE-488
CPEs cpe:2.3:a:federatedai:fate:*:*:*:*:*:*:*:*
Vendors & Products Federatedai
Federatedai fate
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Federatedai Fate
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:51:38.896Z

Reserved: 2026-07-03T16:52:34.586Z

Link: CVE-2026-14621

cve-icon Vulnrichment

Updated: 2026-07-06T16:36:22.826Z

cve-icon NVD

Status : Deferred

Published: 2026-07-04T09:16:27.543

Modified: 2026-07-06T18:16:37.197

Link: CVE-2026-14621

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T14:45:03Z

Weaknesses
  • CWE-488

    Exposure of Data Element to Wrong Session