CVE-2026-109441: Improper Isolation or Compartmentalization in ginlix-ai LangAlpha

CVE-2026-109441 describes an improper isolation or compartmentalization vulnerability in ginlix-ai's LangAlpha product through version 2026.09.07. The issue arises because all tenant sandbox containers are placed on Docker's shared default bridge network with inter-container communication enabled. Authenticated users who can execute code in their own sandbox can exploit this to connect directly to other tenants' containers, bypassing require_workspace_owner checks. This enables unauthorized access to files such as vault secrets from exposed servers within other tenants' containers.

The vulnerability allows authenticated users with code execution privileges in their sandbox to bypass workspace ownership checks and access other tenants' sandbox containers. This can lead to unauthorized disclosure of sensitive information, including vault secrets, compromising tenant data confidentiality. The CVSS 4.0 score of 6.9 indicates a medium severity impact, reflecting the need for authentication and some attack complexity.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restricting authenticated user code execution privileges and isolating tenant containers outside the default Docker bridge network may reduce risk.