CVE-2026-14621 FederatedAI FATE OSX Broker Session Data Leak

Technical summary

CVE-2026-14621 exists in the QueuePushReqStreamObserver.initEggroll method within the OSX Broker component of FederatedAI FATE up to version 2.2.0. The flaw stems from insufficient validation of queue routing parameters—specifically rollSiteSessionId, dstRole, and dstPartyId—which map data streams to their intended recipients in a federated learning context. An attacker with valid credentials can supply crafted values to redirect data packets to unintended sessions, resulting in confidentiality breach. The vulnerability is classified under CWE-488 (Exposure of Data Element to Wrong Session).

Business impact

In federated learning environments where FATE orchestrates collaborative model training across multiple parties, session isolation is a core security assumption. Successful exploitation allows leakage of training data or intermediate model updates between organizations that should remain isolated. For enterprises using FATE in financial services, healthcare, or research consortia, this could expose proprietary datasets or compromise the integrity of collaborative analytics. The requirement for prior authentication limits immediate mass-exploitation risk, but insider threat and lateral movement scenarios remain viable.

Affected systems

FederatedAI FATE versions up to and including 2.2.0 are affected. The vulnerability is specific to deployments using the OSX Broker component. Verify your installed version and check the FATE release notes to determine if you are running a vulnerable build. Organizations not using the OSX Broker or running only the core FATE platform without distributed queue services may have lower exposure.

Exploitability

Exploitation requires valid login credentials (authenticated access) and knowledge of target session identifiers or role/party configurations within the FATE cluster. The attack complexity is rated as high, meaning an attacker must overcome significant environmental constraints. The exploit has been disclosed publicly, increasing awareness among potential attackers, though the authentication barrier and complexity constraints prevent trivial weaponization. This is not a pre-authentication remote code execution vulnerability.

Remediation

Apply the patch when the pending pull request is merged and released by the FederatedAI project. Until then, apply defense-in-depth measures: restrict network access to the OSX Broker to trusted internal networks, enforce strong authentication and session management policies, audit queue operations for anomalous session transitions, and segment federated learning participants by security trust level. Monitor for unusual cross-session data flows in your FATE logs.

Patch guidance

Monitor the FederatedAI FATE GitHub repository and release channels for notification of a patched version above 2.2.0. At the time of this advisory, the fix is in pull request form and awaits mainline acceptance. Do not delay patching once a release is available, as public disclosure increases the risk window. Test patches in a non-production environment that replicates your OSX Broker topology before deployment to production federated learning pipelines.

Detection guidance

Enable audit logging on your FATE OSX Broker to capture queue push operations, focusing on cases where rollSiteSessionId, dstRole, or dstPartyId parameters change unexpectedly or route data to sessions outside the authenticated user's expected scope. Implement anomaly detection on session-to-session data transfers; federated learning workflows typically follow predictable party-to-party communication patterns. Cross-reference authentication logs with unusual queue operation patterns to identify credential abuse.

Why prioritize this

Despite its low CVSS score, this vulnerability merits attention in federated learning environments due to the sensitivity of collaborative training data and the likelihood that exploitation targets high-value datasets. Organizations that depend on FATE for multi-party analytics should prioritize patching once a release is available. However, the authentication requirement and high attack complexity make this a medium-priority item relative to unauthenticated critical vulnerabilities in your infrastructure.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects the authentication requirement, high attack complexity, and limited scope (confidentiality impact only, no integrity or availability damage). However, contextual factors—data sensitivity in federated learning, public exploit disclosure, and potential insider threat vectors—warrant treating this as higher priority than the numerical score alone suggests. Organizations should apply a business-driven risk model that factors in the confidentiality classification of their federated learning datasets.

Frequently asked questions