{"id":"CVE-2026-129130","kind":"vulnerability","aliases":["CVE-2026-129130"],"related":[],"title":"agent-device: authenticated remote callers can read daemon-host files","description":"agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated remote callers to read daemon-host files by opening file:// URLs. Attackers can send an open command with a file:// target through /rpc, then issue snapshot to read any plaintext file readable by the daemon account.","summary":"agent-device, a tool that lets AI agents drive devices, versions 0.21.36 before 0.21.37 let an authenticated remote caller open file:// URLs through its /rpc endpoint. The caller can then read any plaintext file the daemon account can read.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agent-device","ai-agents","ai-tooling","node"],"not_affected_if":["auth-required","daemon-not-exposed","version-0.21.37-or-later"],"how_to_check":"- Check the installed agent-device version, e.g. `npm ls agent-device` in the project, and compare it with `0.21.37`.\n- Confirm whether the daemon's /rpc endpoint is reachable from outside the machine.","fix":"- agent-device: move to `0.21.37` or later.","status":"open","published_at":"2026-11-13T17:17:30+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","triaged_at":"2026-11-13T17:48:54+00:00","updated_at":"2026-11-13T17:48:54+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-13T17:48:54Z","model":"claude-haiku-5-5","output":{"fix":"- agent-device: move to `0.21.37` or later.","reach":"network","title":"agent-device: authenticated remote callers can read daemon-host files","impact":"medium","summary":"agent-device, a tool that lets AI agents drive devices, versions 0.21.36 before 0.21.37 let an authenticated remote caller open file:// URLs through its /rpc endpoint. The caller can then read any plaintext file the daemon account can read.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["agent-device","ai-agents","node"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"remote caller reads plaintext files the daemon account can access","analyst_note":"","how_to_check":"- Check the installed agent-device version, e.g. `npm ls agent-device` in the project, and compare it with `0.21.37`.\n- Confirm whether the daemon's /rpc endpoint is reachable from outside the machine.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.21.37-or-later","daemon-not-exposed","auth-required"],"who_is_affected":"Teams that run the agent-device daemon and expose its /rpc endpoint to callers who hold credentials, including automation or agent setups. Exposure depends on whether untrusted or less-trusted accounts can reach the daemon and on what files the daemon account can read. Installations on 0.21.37 or later, or with the daemon kept local and only trusted callers, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4631,"output_tokens":563,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129130':15A,18A '-2026':14A,17A '/rpc':53B,105C '0.21.36':41B,72C '0.21.37':43B,74C 'account':65B,118C 'agent':2A,20B,24B,30B,37B,69C 'agent-devic':1A,19B,29B,68C 'ai':23B,26B,36B 'ai-ag':22B 'ai-tool':25B 'allow':82C 'attack':95C 'authent':4A,46B,83C 'caller':6A,48B,56B,85C 'command':100C 'contain':75C 'cve':13A,16A 'daemon':10A,64B,89C,117C 'daemon-host':9A,88C 'devic':3A,21B,31B,39B,70C 'disclosur':79C 'drive':38B 'endpoint':54B 'file':12A,62B,78C,91C,113C 'host':11A,90C 'issu':107C 'let':35B,44B 'local':77C 'node':28B 'open':49B,93C,99C 'plaintext':61B,112C 'read':8A,59B,67B,87C,110C 'readabl':114C 'remot':5A,47B,84C 'send':97C 'snapshot':108C 'target':103C 'tool':27B,33B 'url':50B,94C 'version':40B 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the agent-device daemon and expose its /rpc endpoint to callers who hold credentials, including automation or agent setups. Exposure depends on whether untrusted or less-trusted accounts can reach the daemon and on what files the daemon account can read. Installations on 0.21.37 or later, or with the daemon kept local and only trusted callers, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agentdevice","aiagents","aitooling","high","node"],"campaign_type":null,"search_a":"'-129130':15A,18A '-2026':14A,17A 'agent':2A 'agent-devic':1A 'authent':4A 'caller':6A 'cve':13A,16A 'daemon':10A 'daemon-host':9A 'devic':3A 'file':12A 'host':11A 'read':8A 'remot':5A","search_b":"'/rpc':53B '0.21.36':41B '0.21.37':43B 'account':65B 'agent':20B,24B,30B,37B 'agent-devic':19B,29B 'ai':23B,26B,36B 'ai-ag':22B 'ai-tool':25B 'authent':46B 'caller':48B,56B 'daemon':64B 'devic':21B,31B,39B 'drive':38B 'endpoint':54B 'file':62B 'let':35B,44B 'node':28B 'open':49B 'plaintext':61B 'read':59B,67B 'remot':47B 'tool':27B,33B 'url':50B 'version':40B","search_c":"'/rpc':105C '0.21.36':72C '0.21.37':74C 'account':118C 'agent':69C 'agent-devic':68C 'allow':82C 'attack':95C 'authent':83C 'caller':85C 'command':100C 'contain':75C 'daemon':89C,117C 'daemon-host':88C 'devic':70C 'disclosur':79C 'file':78C,91C,113C 'host':90C 'issu':107C 'local':77C 'open':93C,99C 'plaintext':112C 'read':87C,110C 'readabl':114C 'remot':84C 'send':97C 'snapshot':108C 'target':103C 'url':94C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T09:19:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129130","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129130","severity":null,"published_at":"2026-11-13T17:17:30+00:00","modified_at":"2026-11-13T17:17:30+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","fetched_at":"2026-11-13T17:48:01+00:00","note":null}],"documents":[{"id":148130,"url":"https://github.com/callstack/agent-device/commit/2deb909ec88bbbde615ec7c8f3895ef222d8ab3d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148131,"url":"https://github.com/callstack/agent-device/releases/tag/v0.21.37","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":148132,"url":"https://github.com/callstack/agent-device/security/advisories/GHSA-g87j-p64h-w8wc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-13T09:19:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":148133,"url":"https://www.vulncheck.com/advisories/agent-device-0.21.36-local-file-disclosure-via-file-navigation-in-open-command","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}