{"id":"CVE-2026-129157","kind":"vulnerability","aliases":["CVE-2026-129157"],"related":[],"title":"ragent: any logged-in user can read other users' RAG traces","description":"ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details.","summary":"ragent 1.0.0 through 1.1.0 has a missing authorization check in its RagTraceController, so any signed-in user can list all users' RAG traces. An attacker can read other users' usernames, user ids, conversation ids, questions and per-node execution details through the /rag/traces endpoints.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ragent","fixed":[],"affected":">= 1.0.0, <= 1.1.0","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","multi-user","rag","ragent","self-hosted"],"not_affected_if":["auth-required","single-user","trace-endpoints-blocked"],"how_to_check":"- Check your ragent version: 1.0.0 through 1.1.0 are affected (the report reproduced it on commit c3b6157).\n- Log in as a non-admin user and request GET /api/ragent/rag/traces/runs?pageNo=1&pageSize=5. If it returns 200 with other users' questions and usernames, you are exposed. /users returning a permission error for the same user does not mean the trace endpoint is protected.","fix":"No fixed version published as of 2026-11-13; issue #186 is still open. Until a patch ships, block /rag/traces/* at the reverse proxy or restrict it to admins, and limit accounts to trusted users.","status":"open","published_at":"2026-11-13T18:17:40+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","triaged_at":"2026-11-13T18:51:58+00:00","updated_at":"2026-11-13T18:52:39+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-13T18:51:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ragent: any logged-in user can read other users' RAG traces","impact":"medium","summary":"ragent 1.0.0 through 1.1.0 has a missing authorization check in its RagTraceController, so any signed-in user can list all users' RAG traces. An attacker can read other users' usernames, user ids, conversation ids, questions and per-node execution details through the /rag/traces endpoints.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["ragent","rag","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Other users' questions and conversation data readable by any logged-in user","analyst_note":"Confirm the fixed version and any vendor workaround from the NVD entry or the VulnCheck advisory; the sources give no fix.","how_to_check":"- Check the installed ragent version against the affected range `1.0.0` through `1.1.0`.\n- Look for the RagTraceController endpoints `/rag/traces/runs` and related node routes in your deployment.","plain_action":"","product_name":"ragent","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams running ragent versions 1.0.0 through 1.1.0 where ordinary logged-in users can reach the RAG trace endpoints. Deployments with only trusted or single users, or with the trace endpoints blocked at the proxy, are less exposed. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000749,"input_tokens":4591,"output_tokens":579,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor workaround from the NVD entry or the VulnCheck advisory; the sources give no fix.","search":"'-129157':15A,18A '-2026':14A,17A '/rag/traces':75B '/rag/traces/runs':105C '1.0.0':32B,78C '1.1.0':34B,80C 'ai':21B 'ai-tool':20B 'allow':89C 'attack':56B,101C 'author':38B,84C 'check':39B 'contain':81C 'convers':64B,117C 'cve':13A,16A 'detail':72B,125C 'endpoint':76B,109C 'execut':71B,124C 'host':30B 'id':63B,65B,116C,118C 'list':50B 'log':4A,92C 'logged-in':3A,91C 'miss':37B,83C 'multi':24B 'multi-us':23B 'node':70B,108C,123C 'page':103C 'per':69B,122C 'per-nod':68B,121C 'question':66B,119C 'rag':11A,26B,53B,99C 'ragent':1A,19A,27B,31B,77C 'ragtracecontrol':42B,87C 'read':8A,58B,111C 'relat':107C 'self':29B 'self-host':28B 'sign':46B 'signed-in':45B 'tool':22B 'trace':12A,54B,100C 'user':6A,10A,25B,48B,52B,60B,62B,94C,98C,113C,115C 'usernam':61B,114C 'view':96C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted ragent 1.0.0 through 1.1.0 (nageoffer/ragent) where more than one person has an account. Any logged-in regular user can read other users' usernames, user ids, conversation ids, questions and per-node trace details through /rag/traces/runs. Single-user or fully trusted-user deployments, or ones that block the trace endpoints at the proxy, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ragent"],"ptokens":["ragent"],"labels":["aitooling","medium","multiuser","rag","ragent","selfhosted"],"campaign_type":null,"search_a":"'-129157':15A,18A '-2026':14A,17A 'cve':13A,16A 'log':4A 'logged-in':3A 'rag':11A 'ragent':1A,19A 'read':8A 'trace':12A 'user':6A,10A","search_b":"'/rag/traces':75B '1.0.0':32B '1.1.0':34B 'ai':21B 'ai-tool':20B 'attack':56B 'author':38B 'check':39B 'convers':64B 'detail':72B 'endpoint':76B 'execut':71B 'host':30B 'id':63B,65B 'list':50B 'miss':37B 'multi':24B 'multi-us':23B 'node':70B 'per':69B 'per-nod':68B 'question':66B 'rag':26B,53B 'ragent':27B,31B 'ragtracecontrol':42B 'read':58B 'self':29B 'self-host':28B 'sign':46B 'signed-in':45B 'tool':22B 'trace':54B 'user':25B,48B,52B,60B,62B 'usernam':61B","search_c":"'/rag/traces/runs':105C '1.0.0':78C '1.1.0':80C 'allow':89C 'attack':101C 'author':84C 'contain':81C 'convers':117C 'detail':125C 'endpoint':109C 'execut':124C 'id':116C,118C 'log':92C 'logged-in':91C 'miss':83C 'node':108C,123C 'page':103C 'per':122C 'per-nod':121C 'question':119C 'rag':99C 'ragent':77C 'ragtracecontrol':87C 'read':111C 'relat':107C 'trace':100C 'user':94C,98C,113C,115C 'usernam':114C 'view':96C 'vulner':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-129157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129157","severity":null,"published_at":"2026-11-13T18:17:40+00:00","modified_at":"2026-11-13T18:17:40+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","fetched_at":"2026-11-13T18:49:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129157:3917","url":"https://github.com/nageoffer/ragent/issues/186","severity":null,"published_at":"2026-11-13T18:52:39+00:00","modified_at":"2026-11-13T18:52:39+00:00","first_seen_at":"2026-11-13T18:52:39+00:00","fetched_at":"2026-11-13T18:52:39+00:00","note":"Read VulnCheck advisory, researcher report (vul.yulun.ac.cn) and maintainer GitHub issue #186 (open since 2026-11-04, no maintainer reply or fixed release seen). Public PoC in the report; no exploitation reported.","cites":["https://github.com/nageoffer/ragent/issues/186","https://vul.yulun.ac.cn/20261104/ragent/"]}],"documents":[{"id":148615,"url":"https://www.vulncheck.com/advisories/ragent-1.0.0-through-1.1.0-missing-authorization-via-rag-traces-runs","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":148648,"url":"https://github.com/nageoffer/ragent/issues/186","title":"ragent #186: regular user can read /rag/traces/runs","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":148649,"url":"https://vul.yulun.ac.cn/20261104/ragent/","title":"Ragent Vulnerability Report (Wu Yulun)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://vul.yulun.ac.cn/20261104/ragent/"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}