CVE-2026-12203: HKUDS AI-Trader information disclosure through research agents export endpoint

Summary

A vulnerability in HKUDS AI-Trader, up to commit 74caf996f78dcc0c657df8365c8544678a16e215, affects an unknown part of the file /api/research/agents.csv in the Research Export component. Manipulating it leads to information disclosure, and remote exploitation is possible. The exploit has been made public. The project uses a rolling release, so no affected version details are given.

Mitigation

The patch is named 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65, and applying it is the recommended action. The vendor confirms: "Research export endpoints now require an authenticated agent with the research_exports capability".

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online