The supervisor workload server lacks proper authentication, allowing workloads to manipulate runs from other deployments without ownership verification. An attacker with network access and a valid run/snapshot pair can access the 'attempts/start' endpoint to retrieve resolved environment variables and run JWTs (JSON Web Tokens, which are used for secure transmission of information between parties). Additionally, this allows the attacker to start, complete, or suspend runs belonging to other tenants.