CVE-2026-102344 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
The lavish-axi local HTTP server for AI agent sessions skipped authentication and Host/Origin checks before 0.1.43. A website visited while the server runs can read any file the server process can read, and queue prompts into an active agent session.
first public Jul 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running lavish-axi locally with an agent session, where a browser on the same machine can reach the loopback server. Machines without lavish-axi running, or on a fixed version, are not exposed. The sources do not say whether any default configuration is affected.
Not affected if server-not-running, version-0.1.43-or-later
Who cares ai-agents, developer-machines, lavish-axi
0.1.43.0.1.43.Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.