Description
Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary execution_id values to retrieve sensitive execution records including task inputs, outputs, metadata, and temporal task tokens from other tenants.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
julep-ai julep
Default version status: unaffected
0 to < 5371a620af2582868eb121e6489a8cc14836fd50affected
pkg:github/julep-ai/julep