Improper Input Validation in AgentVerus Scanner from AgentVerus
CVE-2026-101079

2.4LOW

Key Information:

Vendor

Agentverus

Status
Agentverus-scanner
Vendor
CVE Published:
28 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-101079?

A vulnerability exists in the AgentVerus Scanner affecting versions up to 0.8.1, primarily in the isSecurityDefenseSkill function within context.js. This flaw allows an attacker to manipulate security decisions by relying on untrusted inputs, potentially leading to unauthorized actions. The attack can only be initiated from a local environment. Alerts regarding this issue were raised, but no response has been initiated by the project team to address the vulnerability publicly.

Affected Version(s)

agentverus-scanner 0.8.0

agentverus-scanner 0.8.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-101079 - Proof of Concept

References

https://vuldb.com/vuln/410950
vdb-entrytechnical-description
https://vuldb.com/vuln/410950/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101079
third-party-advisory

CVSS V4

Score:
2.4
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

nedlir (VulDB User)
VulDB CNA Team
.