CERT /CC and security researchers have disclosed three high-risk DataElement Bisheng vulnerabilities affecting the open-source Bisheng platform used for building and managing LLM applications. The flaws, tracked as CVE-2026-96679, CVE-2026-96681, and CVE-2026-100156, could enable unauthenticated admin takeover and credential abuse, potentially allowing attackers to access hardcoded credentials and run unauthorised AI inferences billed to third-party accounts.
CERT/CC notes that while fixes exist for two of the flaws, the first (CVE-2026-96679) remains unpatched and requires manual mitigation. At present there is no confirmed exploitation in the wild.
Details published in coordination with CERT/CC describe how each flaw could be exploited. CVE-2026-96679 affects the legacy SSO endpoint (POST /user/sso) when BISHENG_PRO is enabled; it permits an attacker to obtain a valid JWT without proper caller authentication, potentially granting super-administrator privileges. CVE-2026-96681 (an IDOR) allows any logged-in user to read complete workflow configurations from other accounts due to insufficient verification of record ownership.
CVE-2026-100156 affects the auto task endpoints (POST /api/v1/assistants/auto/task and GET /api/v1/assistants/auto), enabling credential hijacking and leakage of workflow tools through unauthorised access to an assistant’s data. The affected versions are outlined as: CVE-96679 – all Bisheng releases with the legacy SSO enabled (unpatched); CVE-96681 – prior to 3.0.0; CVE-100156 – prior to 2.5.0. Patch history shows DataElement fixed CVE-100156 in 2.5.0 and CVE-96681 in 3.0.0, but no public fix for 96679.
Interim mitigations recommended by CERT/CC include avoiding BISHENG_PRO, disabling the sso() function in src/backend/bisheng/user/api/user[.]py, and restricting POST /user/sso to loopback or same-origin requests until a patch arrives.