CVE-2026-77604 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Code Graph RAG's MCP read_file tool skips its path containment check when paging is requested, so an absolute or traversal path can read any UTF-8 file the server process can open. An unauthenticated caller of a network-exposed HTTP MCP server can read credentials, keys, environment data and source.
first public Jul 14, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Code Graph RAG as an MCP server, especially over the HTTP transport on a network interface, are exposed because the read_file tool's paginated branch does not validate paths. Local stdio use reaches the same code path, so local users of the tool are also in scope. Installations that are not running the MCP server are not affected by this flaw.
Not affected if no-mcp-server, stdio-only-local-use
Who cares code-graph-rag, mcp, python, self-hosted
0.0.345 is affected.read_file is called with offset or limit parameters.0.0.345.Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_path input to project_root without resolving and verifying containment when offset or limit selects the paginated branch. An absolute path causes pathlib to discard the configured root, while relative traversal can also resolve outside it. The protected non-paginated branch uses validate_project_path, but the paginated branch bypasses that validation before opening the path. An unauthenticated caller of a network-exposed HTTP MCP server can therefore read arbitrary UTF-8-readable files available to the server process, including credentials, environment data, private keys, source, and configuration; local callers through the stdio transport can reach the same vulnerable code path. This issue is fixed in version 0.0.345.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.