CERT/CC Discloses Three DataElement Bisheng Vulnerabilities Allowing Admin Account Takeover and Credential Abuse
Do Son 
TL;DR
CERT/CC and security researcher Louis Sanchez of Voke Cyber disclosed three high-risk Bisheng vulnerabilities affecting the open-source LLM DevOps platform by DataElement. Tracked as CVE-2026-96679, CVE-2026-96681, and CVE-2026-100156, these flaws allow unauthenticated super-administrator takeover and cross-user AI credential theft. While the vendor patched two flaws in versions 2.5.0 and 3.0.0, CVE-2026-96679 remains unpatched and requires manual mitigation.
- Vulnerabilities: 3 flaws (CVE-2026-96679, CVE-2026-96681, CVE-2026-100156)
- Highest severity: Awaiting analysis
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | Status |
|---|---|
| CVE-2026-96679 | Not exploited |
| CVE-2026-96681 | Not exploited |
| CVE-2026-100156 | Not exploited |
Why These DataElement Bisheng Vulnerabilities Matter
Engineering teams use the open-source Bisheng platform to build, manage, and scale Large Language Model (LLM) applications. According to the official CERT/CC VU#166125 note, “together, these flaws could allow unauthenticated attackers to gain administrative control while enabling authenticated users access to sensitive data and hardcoded credentials.” Furthermore, attackers can abuse victim API keys to run unauthorized AI inferences billed to OpenAI, Azure, or Anthropic accounts. While Voke Cyber published technical details in coordination with CERT/CC, neither source has confirmed active exploitation in the wild.
How the Attacks Work
Unauthenticated Legacy SSO Account Takeover (CVE-2026-96679)
Rated 9.8 Critical by researchers, CVE-2026-96679 affects the legacy Single Sign-On endpoint at POST /user/sso when BISHENG_PRO is enabled. Specifically, “the application processes incoming JSON payloads containing arbitrary usernames and issues a valid JSON Web Token (JWT) without enforcing any form of caller authentication, such as signature verification, shared secrets, or network allowlisting.” If an attacker supplies an non-existent username that matches the configured admin name or registers as the first user, the system grants super-administrator privileges automatically.
IDOR Workflow Exposure and LLM Credential Abuse (CVE-2026-96681 and CVE-2026-100156)
Meanwhile, the other two DataElement Bisheng vulnerabilities allow authenticated users to cross tenant boundaries. First, CVE-2026-96681 (CVSS 6.5) is an Insecure Direct Object Reference (IDOR) flaw where version retrieval endpoints fail to verify record ownership. Consequently, any logged-in user can read complete Domain-Specific Language (DSL) workflow configurations belonging to other accounts.
Second, CVE-2026-100156 affects the prompt auto-optimization endpoints at POST /api/v1/assistants/auto/task and GET /api/v1/assistants/auto. Because the service accepts an assistant identifier without verifying ownership, an attacker can hijack another user’s assistant credentials and leak workflow tools.
Affected Products and Versions
Based on CERT/CC VU#166125 and Voke Cyber’s findings, the Bisheng vulnerabilities impact the following releases:
- CVE-2026-96679: All DataElement Bisheng versions with the legacy SSO endpoint enabled (currently unpatched).
- CVE-2026-96681: DataElement Bisheng versions prior to 3.0.0.
- CVE-2026-100156: DataElement Bisheng versions prior to 2.5.0.
Patch Details and Mitigation Steps
DataElement fixed CVE-2026-100156 in Bisheng version 2.5.0 and resolved CVE-2026-96681 in version 3.0.0. However, CERT/CC notes that “for the remaining unpatched vulnerability (CVE-2026-96679), DataElement/Bisheng has not responded to multiple coordination efforts.” Until an official patch arrives, administrators should avoid setting BISHENG_PRO=true, disable the sso() function in src/backend/bisheng/user/api/user.py, and restrict POST /user/sso network access to loopback or same-origin requests.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
