← Database

CVE-2026-129157

MEDIUM CVSS: 4.3 Published: 2026-11-13 Modified: 2026-11-13

Description

ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details.

Affected Platforms

Unknown

Weakness Type

CWE-862

References