CVE-2026-121938 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
langchain4j-aideepin before 3.31.0 has an insecure direct object reference: GET /character/{uuid} returns a character's data without checking that the requester owns it. An authenticated user who knows another user's character uuid can read that person's questions, AI answers, and attachment and audio URLs.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams that run langchain4j-aideepin as a multi-user chat service with character features. Exposure requires a logged-in account; single-user or non-character deployments are less exposed. The sources do not say whether any public instance is reachable without authentication.
Not affected if single-user, version-3.31.0-or-later
Who cares java, langchain4j-aideepin, multi-user, self-hosted
3.31.0.CharacterService.detail lookup behind GET /character/{uuid} and confirm whether it verifies the caller owns the character.3.31.0 or later.langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs.
This page as .md · .json · in your agent: get_signal("CVE-2026-121938") · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.