CVE-2026-129157

A signed-in ragent user could read another user’s retrieval traces

nageoffer · ragent RAG trace viewer

First documented disclosure · Review checkpoint

Summary

The trace viewer authenticated requests without checking who owned each trace. Other users’ questions, conversation and user identifiers, and trace execution details could be exposed.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reporting researcher demonstrated cross-user access with controlled accounts. The reviewed record identifies no malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The trace viewer authenticated requests without checking who owned each trace.

Conditions required

A user could sign in to an affected ragent deployment.

Potential impact

Other users’ questions, conversation and user identifiers, and trace execution details could be exposed.

Affected versions and configurations

1.0.0 through 1.1.0.

Fix and mitigation status

The CNA and reporter identify no fixed release.

Practical next steps

Restrict trace access to trusted operators and enforce ownership checks for trace lists and details.

Operating lesson

Apply the same ownership policies to traces as to the conversations they describe.

Evidence and limits

The CVE record was published on 2026-11-13.

Sources