Description
A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Published: 2026-07-04
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the QueuePushReqStreamObserver.initEggroll routine of the OSX Broker component in FederatedAI FATE allows an attacker to manipulate the dstRole and dstPartyId parameters, causing data elements to be exposed to unintended sessions. This session-handling weakness (CWE-488) can lead to confidential data leaking between parties that should not share that data.

Affected Systems

The vulnerability affects deployments of FederatedAI FATE up to and including version 2.2.0. If the OSX Broker component is used in a production environment, administrators should verify that no vulnerable session handling code is active.

Risk and Exploitability

The CVSS score of 2.3 places this flaw in the low severity range, and the EPSS score is less than 1%, indicating that the likelihood of widespread exploitation is currently low. The flaw is not listed in any current KEV catalog. The attack can be and the exploitation conditions are considered difficult; however, that now if the conditions are met.

Generated by OpenCVE AI on July 26, 2026 at 21:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the approved FederatedAI patch once it is merged, or upgrade toe.g., 2.2.1 or later) that contains the fix.
  • Restrict external access to the OSX Broker component with firewall rules or network segmentation to reduce the attack surface and prevent remote manipulation of session identifiers.
  • Implement strict input validation or enforce correct user session handling for rollSiteSessionId, dstRole, and dstPartyId so that only intended session identifiers are accepted by the QueuePushReqStreamObserver endpoint, and alert on anomalous session ID usage.

Generated by OpenCVE AI on July 26, 2026 at 21:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such manipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to wrong session. The attack can be executed remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Title FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session
First Time appeared Federatedai
Federatedai fate
Weaknesses CWE-488
CPEs cpe:2.3:a:federatedai:fate:*:*:*:*:*:*:*:*
Vendors & Products Federatedai
Federatedai fate
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Federatedai Fate
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:51:38.896Z

Reserved: 2026-07-03T16:52:34.586Z

Link: CVE-2026-14621

cve-icon Vulnrichment

Updated: 2026-07-06T16:36:22.826Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T22:00:05Z

Weaknesses
  • CWE-488

    Exposure of Data Element to Wrong Session