GHSA-gwx5-24gg-jphvMediumCVSS 4.3
ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController...
🔗 CVE IDs covered (1)
📋 Description
ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-129157
- https://github.com/nageoffer/ragent/issues/186
- https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/rag/controller/RagTraceController.java#L40-L66
- https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/rag/service/impl/RagTraceQueryServiceImpl.java#L59-L76
- https://vul.yulun.ac.cn/20261104/ragent
- https://www.vulncheck.com/advisories/ragent-1.0.0-through-1.1.0-missing-authorization-via-rag-traces-runs
- https://github.com/advisories/GHSA-gwx5-24gg-jphv