---
id: "CVE-2026-77604"
kind: "vulnerability"
aliases: ["CVE-2026-77604"]
title: "Code Graph RAG: MCP read_file path check bypass exposes server files"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "code-graph-rag", "mcp", "python", "self-hosted"]
not_affected_if: ["no-mcp-server", "stdio-only-local-use"]
published_at: "2026-11-05T20:18:00+00:00"
first_seen_at: "2026-11-05T20:40:46+00:00"
updated_at: "2026-11-05T20:42:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77604", "first_seen_at": "2026-11-05T20:40:46+00:00"}]
exploit_sources: []
---

# Code Graph RAG: MCP read_file path check bypass exposes server files

Code Graph RAG's MCP read_file tool skips its path containment check when paging is requested, so an absolute or traversal path can read any UTF-8 file the server process can open. An unauthenticated caller of a network-exposed HTTP MCP server can read credentials, keys, environment data and source.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Code Graph RAG version; anything below `0.0.345` is affected.
- Look for an HTTP MCP server deployment of Code Graph RAG reachable from the network, since the unauthenticated HTTP transport is the exposed path.
- Review whether `read_file` is called with `offset` or `limit` parameters.

## Fix

- Code Graph RAG: move to `0.0.345`.

## Timeline

- 2026-11-05T20:40:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77604

## Documents

- [advisory] Vendor advisory: github.com https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m
- [fix] Patch: github.com https://github.com/vitali87/code-graph-rag/commit/6541e920a27961fa8f3ff49ef38c0e0bd09cd626
- [fix] Release notes: github.com https://github.com/vitali87/code-graph-rag/releases/tag/v0.0.345

## From the sources

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_path input to project_root without resolving and verifying containment when offset or limit selects the paginated branch. An absolute path causes pathlib to discard the configured root, while relative traversal can also resolve outside it. The protected non-paginated branch uses validate_project_path, but the paginated branch bypasses that validation before opening the path. An unauthenticated caller of a network-exposed HTTP MCP server can therefore read arbitrary UTF-8-readable files available to the server process, including credentials, environment data, private keys, source, and configuration; local callers through the stdio transport can reach the same vulnerable code path. This issue is fixed in version 0.0.345.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_