CVE-2026-129130 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
agent-device, a tool that lets AI agents drive devices, versions 0.21.36 before 0.21.37 let an authenticated remote caller open file:// URLs through its /rpc endpoint. The caller can then read any plaintext file the daemon account can read.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run the agent-device daemon and expose its /rpc endpoint to callers who hold credentials, including automation or agent setups. Exposure depends on whether untrusted or less-trusted accounts can reach the daemon and on what files the daemon account can read. Installations on 0.21.37 or later, or with the daemon kept local and only trusted callers, are not affected.
Not affected if auth-required, daemon-not-exposed, version-0.21.37-or-later
Who cares agent-device, ai-agents, node
npm ls agent-device in the project, and compare it with 0.21.37.0.21.37 or later.agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated remote callers to read daemon-host files by opening file:// URLs. Attackers can send an open command with a file:// target through /rpc, then issue snapshot to read any plaintext file readable by the daemon account.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.