PT-2026-146988

CVE-2026-129130

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions agent-device version 0.21.36

Description An issue allows authenticated remote callers to read files from the daemon host by opening file:// URLs. An attacker can send an open command with a file:// target through the '/rpc' endpoint and then issue a snapshot to read any plaintext file accessible by the daemon account.

Recommendations Update agent-device to version 0.21.37.

Exploitability

Exploit

Fix

Researchers

Michał Pierzchała

Narosec

Vendors

Affected products

Weakness enumeration

CWE-73: External Control of File Name or Path

Related identifiers