CVE-2026-87008: Code Graph RAG symlink traversal in structural search and replace

Summary

Code Graph RAG versions before 0.0.589 resolve file paths lexically when checking project containment, so a symbolic link inside an analyzed repository can point to a file outside the configured root. The structural_search tool discloses that content without an approval gate, and structural_replace with dry_run=False can overwrite it, including through the MCP path, which skips the agent-loop approval control. An attacker who gets a victim to analyze such a repository can read credentials or environment files and modify files the process can write.

Mitigation

Fixed in 0.0.589.

Topics

• Retrieval-augmented generation

Related items

• MediumThreat actors use agentic AI tooling to find and abuse exposed secretsSimilar attack · Microsoft Security Blog
• HighCVE-2026-88980: Kubeflow Pipelines artifact fetch flaw enables server-side request forgerySimilar attack · NVD/CVE Database
• CriticalCVE-2026-77596: Kubeflow Pipelines authorization bypass in pipeline upload endpointsSimilar attack · NVD/CVE Database
• HighCVE-2026-113663: AG2 SandboxShellTool command injection via newline separatorsSimilar attack · NVD/CVE Database
• MediumCVE-2026-88986: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0…Similar attack · NVD/CVE Database