Local File Disclosure Vulnerability in agent-device from Callstack

CVE-2026-129130

What is CVE-2026-129130?

The agent-device product from Callstack before version 0.21.37 is susceptible to a local file disclosure vulnerability. This issue enables authenticated remote users to access daemon-host files through file:// URLs. Attackers can exploit this vulnerability by sending an open command with a file:// target via the /rpc interface and then issuing a snapshot command, allowing them to read any plaintext files available to the daemon account. It is crucial for users to upgrade to version 0.21.37 or later to mitigate this risk.

References