CVE-2026-116228

agent-teams-ai local HTTP service exposes session information without authentication

777genius · agent-teams-ai

First documented disclosure · Review checkpoint

Summary

A local process can read sensitive session and configuration information from the application HTTP sidecar when it is running.

Severity and exploitation evidence

Medium · 4.8/10 · CVSS 4.0. Severity source.

Exploitation not established: Real-world malicious exploitation is not established by the reviewed primary sources; a vulnerability report or public demonstration is not evidence of a victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The local Fastify sidecar has no authentication on read endpoints; binding to loopback and applying browser CORS rules do not authenticate local callers.

Conditions required

Local access to the machine and a running sidecar, enabled through HTTP-server configuration or started for team control. This is not an unauthenticated internet-facing attack.

Potential impact

Exposure can include conversation text, code/tool context, token usage and SSH host, username and identity-file paths. The researcher explicitly excludes direct provider API-key, SSH-password and browser-cookie retrieval.

Affected versions and configurations

CNA describes versions through 2.17.10 and enumerates 2.17.0–2.17.10; the submitted report title says 2.15.0 while its tested-build text says 2.1.2, so that discrepancy remains unresolved.

Fix and mitigation status

Unknown; no fixed version is verified.

Practical next steps

Avoid starting the HTTP sidecar when unnecessary, restrict untrusted local software and isolate agent workspaces. A durable fix must authenticate local API requests.

Operating lesson

Loopback services carrying agent memory still need caller authentication.

Evidence and limits

VulDB disclosed October 25; CNA publication was October 26. The September 29 submission is not counted as public disclosure. Public reproduction is described, not an observed malicious campaign.

Sources