CVE-2026-129157
ragent 1.0.0 through 1.1.0 Missing Authorization via /rag/traces/runs
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details.
| CWE | CWE-862 |
| Vendor | nageoffer |
| Product | ragent |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for nageoffer ragent
Be the first to know when new medium vulnerabilities affecting nageoffer ragent are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
nageoffer / ragent
1.0.0 ≤ 1.1.0
References
vul.yulun.ac.cn: https://vul.yulun.ac.cn/20261104/ragent/ github.com: https://github.com/nageoffer/ragent/issues/186 github.com: https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/rag/controller/RagTraceController.java#L40-L66 github.com: https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/rag/service/impl/RagTraceQueryServiceImpl.java#L59-L76 vulncheck.com: https://www.vulncheck.com/advisories/ragent-1.0.0-through-1.1.0-missing-authorization-via-rag-traces-runs
Credits
Wu Yulun