Path Traversal Vulnerability in Code Graph RAG Affects Credentials and Source Files

CVE-2026-77604

What is CVE-2026-77604?

An unauthenticated user can exploit a vulnerability in Code Graph RAG's MCPToolsRegistry.read_file function to access sensitive files. By manipulating file_path input, an attacker can either bypass configured paths or use relative traversal to access files outside the intended directory. This flaw permits retrieval of arbitrary UTF-8-readable files, potentially exposing critical data such as credentials, configuration settings, and private keys. The issue has been addressed in version 0.0.345, which reinforces path validation for secure file handling.

References