agent-teams-ai CVE-2026-116228

Exploitation requires local access to the host running agent-teams-ai (versions up to 2.17.10) and, per PR:L, an existing low level of privilege on that system; the attacker must be able to reach the Local HTTP Service instantiated by the doStart function in src/main/services/infrastructure/HttpServer.ts, which is started without authentication (CWE-306). Limiting factors: it is not remotely reachable (AV:L), so an attacker needs a pre-existing local foothold; impact is confined to low confidentiality disclosure with no integrity or availability effect; and the specific trigger beyond reaching the unauthenticated service is not described in the available sources. Whether the local HTTP service is bound only to localhost or exposed more broadly is not stated in the input and should be verified against the deployment.

This is a low-priority, high-noise item rather than an urgent threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores only 1.9, reflecting that exploitation requires local access and some existing low-level privilege (PR:L), yields only low confidentiality impact, and produces no integrity or availability impact. The signals are mutually consistent and all point downward: no EPSS score was supplied, the vulnerability is NOT in CISA KEV (no confirmed active exploitation), the vuln.today decision label is 'monitor' (the lowest urgency tier), and the embedded CVSS temporal flag E:P indicates only a proof-of-concept maturity. The one amplifying signal is the referenced exploit material, but the input states it is a reference only and not verified as working exploit code, so it should not be treated as a weaponized exploit. The 'missing authentication' flaw (CWE-306) combined with PR:L is somewhat in tension - an attacker already needs local, low-privileged access to reach the local HTTP service before benefiting from its lack of authentication, which caps real-world impact. Net: this is a genuinely low-risk, locally-scoped issue, not a high-CVSS-but-overstated case; the complication is an unresponsive vendor meaning no patch is confirmed.

An attacker who already has a local, low-privileged foothold on the host (e.g., another local user or a sandboxed process) connects to the agent-teams-ai Local HTTP Service started by doStart() in HttpServer.ts, which exposes functionality without authentication, and reads information it should not be able to access. A public PoC reference exists but is not verified as working exploit code, so practical exploitation is plausible but unproven. Because the attack vector is local with low complexity, no user interaction is needed once local access is obtained.