MediumVulnerabilityLLM-specific
CVE-2025-59956: AgentAPI DNS rebinding exposes message history via localhost /messages endpoint
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-59956
- Published
- Record updated
- Affected
- github.com/coder/agentapi < 0.4.0
- Fixed in
- 0.4.0
- released August 13, 2025, 48 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
CVE-2025-59956 affects AgentAPI, an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex, in versions 0.3.3 and below. When hosted over plain HTTP on localhost, these versions are susceptible to a client-side DNS rebinding attack that grants an attacker access to the /messages endpoint. The attacker can exfiltrate local message history, which may include secret keys, file system contents, and intellectual property.
Mitigation
Fixed in version 0.4.0.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online