{"id":"CVE-2026-77604","kind":"vulnerability","aliases":["CVE-2026-77604"],"related":[],"title":"Code Graph RAG: MCP read_file path check bypass exposes server files","description":"Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_path input to project_root without resolving and verifying containment when offset or limit selects the paginated branch. An absolute path causes pathlib to discard the configured root, while relative traversal can also resolve outside it. The protected non-paginated branch uses validate_project_path, but the paginated branch bypasses that validation before opening the path. An unauthenticated caller of a network-exposed HTTP MCP server can therefore read arbitrary UTF-8-readable files available to the server process, including credentials, environment data, private keys, source, and configuration; local callers through the stdio transport can reach the same vulnerable code path. This issue is fixed in version 0.0.345.","summary":"Code Graph RAG's MCP read_file tool skips its path containment check when paging is requested, so an absolute or traversal path can read any UTF-8 file the server process can open. An unauthenticated caller of a network-exposed HTTP MCP server can read credentials, keys, environment data and source.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","code-graph-rag","mcp","python","self-hosted"],"not_affected_if":["no-mcp-server","stdio-only-local-use"],"how_to_check":"- Check the installed Code Graph RAG version; anything below `0.0.345` is affected.\n- Look for an HTTP MCP server deployment of Code Graph RAG reachable from the network, since the unauthenticated HTTP transport is the exposed path.\n- Review whether `read_file` is called with `offset` or `limit` parameters.","fix":"- Code Graph RAG: move to `0.0.345`.","status":"open","published_at":"2026-11-05T20:18:00+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","triaged_at":"2026-11-05T20:42:59+00:00","updated_at":"2026-11-05T20:42:59+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-05T20:42:59Z","model":"claude-haiku-5-5","output":{"fix":"- Code Graph RAG: move to `0.0.345`.","reach":"internet","title":"Code Graph RAG: MCP read_file path check bypass exposes server files","impact":"high","summary":"Code Graph RAG's MCP read_file tool skips its path containment check when paging is requested, so an absolute or traversal path can read any UTF-8 file the server process can open. An unauthenticated caller of a network-exposed HTTP MCP server can read credentials, keys, environment data and source.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["code-graph-rag","mcp","python","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"server files including credentials and private keys readable by attackers","analyst_note":"","how_to_check":"- Check the installed Code Graph RAG version; anything below `0.0.345` is affected.\n- Look for an HTTP MCP server deployment of Code Graph RAG reachable from the network, since the unauthenticated HTTP transport is the exposed path.\n- Review whether `read_file` is called with `offset` or `limit` parameters.","plain_action":"","needs_analyst":false,"not_affected_if":["stdio-only-local-use","no-mcp-server"],"who_is_affected":"Teams running Code Graph RAG as an MCP server, especially over the HTTP transport on a network interface, are exposed because the read_file tool's paginated branch does not validate paths. Local stdio use reaches the same code path, so local users of the tool are also in scope. Installations that are not running the MCP server are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4482,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-77604':15A,18A '-8':58B,194C '0.0.345':108C,230C 'absolut':50B,140C 'ai':20B,90C 'ai-pow':89C 'ai-tool':19B 'also':153C 'arbitrari':192C 'attack':118C 'attacker-control':117C 'avail':197C 'branch':138C,162C,170C 'bypass':9A,171C 'caller':67B,180C,212C 'caus':142C 'check':8A,43B 'code':1A,23B,31B,84C,222C 'code-graph-rag':22B 'codebas':105C,114C 'configur':147C,210C 'contain':42B,130C 'control':119C 'credenti':78B,203C 'cve':13A,16A 'data':81B,205C 'discard':145C 'edit':101C 'environ':80B,204C 'expos':10A,72B,185C 'file':6A,12A,37B,59B,111C,120C,196C 'fix':227C 'graph':2A,24B,32B,85C,93C 'host':30B 'http':73B,186C 'implement':112C 'includ':202C 'input':122C 'issu':225C 'join':116C 'key':79B,207C 'knowledg':92C 'languag':104C 'limit':134C 'local':211C 'mcp':4A,26B,35B,74B,187C 'mcptoolsregistry.read':110C 'multi':103C 'multi-languag':102C 'network':71B,184C 'network-expos':70B,183C 'non':160C 'non-pagin':159C 'offset':132C 'open':64B,175C 'outsid':155C 'page':45B 'pagin':137C,161C,169C 'path':7A,41B,53B,121C,141C,166C,177C,223C 'pathlib':143C 'power':91C 'prior':106C 'privat':206C 'process':62B,201C 'project':124C,165C 'protect':158C 'python':27B 'queri':98C 'rag':3A,25B,33B,86C 'rag/mcp/tools.py':115C 'reach':218C 'read':5A,36B,55B,77B,191C 'readabl':195C 'relat':150C 'request':47B 'resolv':127C,154C 'retriev':95C 'root':125C,148C 'select':135C 'self':29B 'self-host':28B 'server':11A,61B,75B,188C,200C 'skip':39B 'sourc':83B,208C 'stdio':215C 'system':96C 'therefor':190C 'tool':21B,38B 'transport':216C 'travers':52B,151C 'unauthent':66B,179C 'understand':99C 'use':163C 'utf':57B,193C 'valid':164C,173C 'verifi':129C 'version':229C 'vulner':221C 'without':126C","nicknames":[],"mitigations":[],"who_affected":"Teams running Code Graph RAG as an MCP server, especially over the HTTP transport on a network interface, are exposed because the read_file tool's paginated branch does not validate paths. Local stdio use reaches the same code path, so local users of the tool are also in scope. Installations that are not running the MCP server are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","codegraphrag","high","mcp","python","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-14T17:36:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77604","severity":null,"published_at":"2026-11-05T20:18:00+00:00","modified_at":"2026-11-05T20:18:00+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","fetched_at":"2026-11-05T20:40:46+00:00","note":null}],"documents":[{"id":79897,"url":"https://github.com/vitali87/code-graph-rag/commit/6541e920a27961fa8f3ff49ef38c0e0bd09cd626","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79898,"url":"https://github.com/vitali87/code-graph-rag/releases/tag/v0.0.345","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79899,"url":"https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-14T17:36:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}