XAgent: path traversal in the workspace file endpoint reads any host file outside the Docker sandbox

Impact

The /workspace/file handler takes a file_name form field with no path containment check, so parent-directory segments walk out of the agent workspace and read arbitrary files on the host - the advisory names application secrets, database credentials and system files, explicitly outside the Docker sandbox the agent is supposed to be confined to. Registration needs no email verification and default credentials are in play, so the attacker supplies their own account. Where XAgent is stood up on a GPU node to give an LLM agent a sandbox, this turns that sandbox into a read primitive against the node's filesystem, which is where inference API keys, registry pull secrets and often a kubeconfig or cloud credential live. Read-only, but the credentials it yields are the start of the next step.

Who can reach it

Any network user who can reach the XAgent web service: self-register an account (no email verification) or use default credentials, then POST a traversal path to /workspace/file.

What to do

Apply the upstream fix (commit 26f2b6edc75127af524f027c022b382967178e3a, PR 432) and restart the XAgent service; the record names no tagged release, so pull from source rather than waiting for a version number. In the meantime take XAgent off any network a tenant or the internet can reach, disable self-registration, change default credentials, and rotate any secret readable from the container's host mounts. No node drain or reboot involved.

References

Related entries

• Xinference: model launch API executes attacker-supplied Python because trust_remote_code is always onCVE-2026-76841 · Xinference (Xorbits Inference) model loaders - trust_remote_codeHigh
• Coze Studio: any registered user gets code execution from a workflow code node by defaultCVE-2026-77934 · Coze Studio (workflow code node, unsandboxed python3 subprocess)High
• Ollama: model pull follows cross-host redirects, giving SSRF to internal and metadata endpointsCVE-2026-85180 · Ollama (tensor-layer blob download, cross-host redirect handling)High
• Axolotl: multipack patch loads Hugging Face base models with trust_remote_code=True, giving RCE on the training nodeCVE-2026-86169 · Axolotl (multipack patch path, trust_remote_code guard)High
• vLLM: rejected requests leak decode-worker metadata until the worker exhausts memoryCVE-2026-93436 · vLLM NIXL KV connector (decode-side metadata cleanup for rejected requests)High
• vLLM: negative token IDs in embeddings requests poison the CUDA context and wedge the engineCVE-2026-93592 · vLLM (/v1/embeddings and /pooling token ID validation)High