SWE-agent trajectory inspector — unauthenticated path traversal on an all-interfaces, wildcard-CORS server leaks trajectory files holding repo contents and API keys (CVE-2026-75482, unpatched)

View raw markdownEdit on GitHub ↗

TL;DR

SWE-agent ships a web viewer for the JSON "trajectory" files its agent runs produce — sweagent inspector — and that viewer is an HTTP server that binds every interface, sets Access-Control-Allow-Origin: *, requires no login, and joins whatever path you give /trajectory/ onto the trajectory directory without rejecting ... Anyone on the network, or any web page the developer opens (via CORS), can read trajectory-shaped JSON files anywhere on the host. Trajectories contain what the agent saw and did: repository contents, command output, and — because runs are configured with model keys and tokens in the environment — API keys and secrets. Reported on GitHub 2026-07-19, a fix PR opened 2026-08-15, CVE-2026-75482 published by VulnCheck as CNA on 2026-08-17 (CVSS 4.0 8.7 / 3.1 7.5). As of 2026-09-13 the issue is open, the PR is unmerged, and SWE-agent has no published security advisory. Affected: every release through 1.1.0.

What happened

GitHub user geo-chen — the same reporter behind aider's .aider.conf.yml auto-exec bug — opened SWE-agent/SWE-agent#1472 on 2026-07-19: "Path traversal in the trajectory inspector reads off-path trajectory/JSON files (unauthenticated, all-interfaces bind, wildcard CORS)." The /trajectory/ handler in sweagent/inspector/server.py takes the request path, joins it to the served trajectory directory, and never checks that the result is still inside it; the built-in sanitization does not reject parent-directory segments. Three configuration choices turn a local viewer bug into a network one: the server binds 0.0.0.0, answers every origin with a wildcard CORS header, and has no authentication. The read sink parses the target as trajectory JSON, so disclosure is limited to JSON files with a trajectory-like shape — which, per VulnCheck's advisory, "can contain repository contents, command output, and secrets/API keys."

VulnCheck published the finding as CVE-2026-75482 on 2026-08-17 (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N = 8.7; CVSS 3.1 7.5; CWE-22), affected ≤ 1.1.0, no patched version, no mitigation listed. NVD carries the same scores and lists the PyPI package sweagent v0 through v1.1.0; the GitHub Advisory Database mirrored it as GHSA-hpx7-jm9p-88gh the same day, unreviewed, with no package or version range filled in. The project's own security-advisories tab says "There aren't any published security advisories."

A community fix exists and has been waiting for a month. PR #1505 (Chessing234, opened 2026-08-15) adds a resolve_trajectory_path() that rejects .. segments — including percent-encoded variants — and absolute paths that escape the served directory, binds 127.0.0.1 by default with an explicit --host flag for deliberate network exposure, drops the unconditional wildcard CORS header, and adds nine regression tests (Codecov reported 92% patch coverage). Its last recorded activity is the bot comment on the day it opened.

Why it belongs in this feed: SWE-agent is one of the reference agent-orchestration frameworks, run routinely on shared research boxes and CI hosts, and the inspector is the way people look at what a run did. A trajectory is a complete transcript of an agent with credentials operating on a repository. Exposing that directory to the LAN — and to any web page via CORS — is the Deadbugz/Grafana MCP pattern from the other side: not an agent being fed bad input, but an agent's output being an unauthenticated network service by default.

Am I affected?

pip show sweagent 2>/dev/null | grep -i '^version'    # any version ≤ 1.1.0 is affected; no fixed release exists
# Is the inspector up, and on what interface?
ps aux | grep -iE 'sweagent (inspector|/inspector)' | grep -v grep
ss -tlnp | grep -i python | grep -v '127.0.0.1'         # inspector bound to 0.0.0.0 shows here
# What could be read: any trajectory-shaped JSON reachable from the served directory upward
find / -name '*.traj' -o -name 'trajectory*.json' 2>/dev/null | head

If the inspector ran bound to all interfaces on a host that is reachable from other machines — or from a browser that visited untrusted pages while it was running — assume every trajectory on that host has been read, and treat any key that appears in a trajectory as leaked.

If you are affected

  1. Stop the inspector; run it only on loopback until a release includes PR #1505 or equivalent (ssh -L to it if you need it from elsewhere). Do not put it behind a "just for the team" wildcard.
  2. Rotate every credential that appears in a trajectory the server could reach — model API keys, GITHUB_TOKENs, anything the agent's environment held: playbooks/if-your-github-pat-leaked.md, playbooks/rotating-cloud-credentials.md.
  3. playbooks/if-your-local-ai-agent-was-exploited.md — the trajectory is the agent's session record; read it as the attacker would have.

Prevention

  • prevention/credential-hygiene.md — keys that reach an agent's environment end up in its logs. Scope and rotate them; never let a long-lived token be the thing a trajectory captures.
  • prevention/agent-sandboxing.md — treat agent artefacts (trajectories, transcripts, tool outputs) as sensitive by default and keep viewers for them off the network.
  • This repo's standing observation for smaller AI-coding tools (aider is the sibling case): no advisory channel means no advisory — the GitHub issue and the CNA record are the disclosure. Watch the tracker, not the (empty) security tab, and keep such tools on latest.

Sources