RAGENT · CVE-2026-129157 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
ragent 1.0.0 through 1.1.0 has a missing authorization check in its RagTraceController, so any signed-in user can list all users' RAG traces. An attacker can read other users' usernames, user ids, conversation ids, questions and per-node execution details through the /rag/traces endpoints.
first public Nov 13, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted ragent 1.0.0 through 1.1.0 (nageoffer/ragent) where more than one person has an account. Any logged-in regular user can read other users' usernames, user ids, conversation ids, questions and per-node trace details through /rag/traces/runs. Single-user or fully trusted-user deployments, or ones that block the trace endpoints at the proxy, can skip it.
Not affected if auth-required, single-user, trace-endpoints-blocked
Who cares multi-user, rag, ragent, self-hosted
ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.