Missing Authorization Vulnerability in RagTraceController of ragent Software by Nageoffer
CVE-2026-129157

5.3MEDIUM

Key Information:

Vendor

Nageoffer

Status
Ragent
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129157?

The ragent software, versions 1.0.0 to 1.1.0, contains a vulnerability in the RagTraceController that allows logged-in users to access sensitive information of other users. This includes the ability to view usernames, user IDs, conversation IDs, questions, and detailed execution information through exposed endpoints. This flaw could lead to unauthorized disclosure of user data, highlighting the importance of implementing proper access controls to protect against such security risks.

Affected Version(s)

ragent 1.0.0 <= 1.1.0

References

https://vul.yulun.ac.cn/20261104/ragent/
third-party-advisory
https://github.com/nageoffer/ragent/issues/186
issue-tracking
https://github.com/nageoffer/ragent/blob/f64de341452c8998...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.