pigeon

Pigeon Your agent spawned a sub-agent and handed it the same API key. That sub-agent can now deploy to production, read the payments database, and merge to main. Pigeon stops that. You hand the child a Pigeon Pass : a narrowed, signed credential for what it may do, not a copy of everything you ca...

CVE-2026-126308 Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps

The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSIONTOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code runnin...

EUVD-2026-125212

The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSIONTOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code runnin...

CVE-2026-126308

The web dashboard in Coder versions 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 is vulnerable to a session token leak . The root cause is that the dashboard replaces the $SESSION_TOKEN placeholder in external app URLs with a f...

PT-2026-146639

The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code runni...

EUVD-2026-120560

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run...

CVE-2026-125397

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run...

CVE-2026-125397: nocobase: NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee()…

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run...

CVE-2026-125397 NocoBase plugin-ai 2.1.0 through 2.2.41 Authorization Bypass via Sub-Agent Username Override

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run...

CVE-2026-125397

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run...

CVE-2026-125397

The NocoBase plugin-ai (versions 2.1.0 through 2.2.41 ) is susceptible to an authorization bypass vulnerability within the getAccessibleAIEmployee() function. The root cause is that authenticated users can access unassigned AI employees by overriding the role-derived filter with a supplied userna...

CVE-2026-125397 NocoBase plugin-ai 2.1.0 through 2.2.41 Authorization Bypass via Sub-Agent Username Override

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run...

PT-2026-141220

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run...

CVE-2026-112015 Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd

Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting osenv.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...

CVE-2026-112015 Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd

Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting osenv.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...

CVE-2026-112015

Omnigent versions 0.3.0 before 0.14.0 are vulnerable to a path traversal vulnerability (CWE-22). The flaw exists because authenticated users can escape the workspace by setting os_env.cwd on nested sub-agents. By uploading a bundle whose sub-agent specifies an absolute or parent-traversing workin...

CVE-2026-112015 Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd

Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting osenv.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...

HermesPentBox

HermesPentBox — AI Pentest Workbench Language: English...

CVE-2026-18998

The CVE concerns cosmicstack-labs mercury-agent up to version 1.1.12. The vulnerability is in SubAgent.run (src/core/sub-agent.ts) of the delegate_task Tool, described as allowing improper authorization and exploitable remotely. Public exploitation details are stated as disclosed, and the project...

EUVD-2026-53712

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegatetask Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The...