CVE-2026-120233

AG-UI redirects can forward agent request data and custom headers

AG-UI Protocol · @ag-ui/client HttpAgent

First documented disclosure · Review checkpoint

Summary

A malicious or compromised agent endpoint can redirect a credential-bearing run request to another origin.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The default fetch initialization omits a redirect policy, so it follows server-chosen redirects without pinning the agent origin.

Conditions required

The client sends a run request to an endpoint controlled or compromised by an attacker. Exposure depends on the headers, runtime and redirect behavior.

Potential impact

The Node24 demonstration forwarded the request envelope and X-Tenant header but stripped cross-origin Authorization and did not carry the test message secret. Full conversation-body forwarding on 307/308 is a researcher claim based on browser fetch behavior, not that measured result.

Affected versions and configurations

CNA lists ag-ui 0.0.1 through 0.0.58; the researcher tested @ag-ui/client 0.0.58.

Fix and mitigation status

No released fix verified. PR #2575 proposing redirect:error remains open and unmerged on November 1.

Practical next steps

Reject redirects for credential-bearing agent requests or use an origin-pinned transport; review custom fetch overrides separately and limit outbound destinations.

Operating lesson

An agent endpoint must not be allowed to choose where client credentials and conversation data are sent.

Evidence and limits

Public report August 25; proposed fix August 30; CVE November 1. CNA assigns Medium 6.9 CVSS 4.0 (also 5.3 CVSS 3.1). Public proof-of-concept availability is not evidence of malicious exploitation. Proposed default-request fix would not cover developer-supplied fetch overrides.

Sources