ag-ui HttpAgent CVE-2026-120233

The run request built by HttpAgent carries the developer's Authorization/Bearer header and the conversation payload. Exploitation requires that the configured HTTP endpoint the client POSTs to - or a man-in-the-middle on that path - return an HTTP redirect to an attacker-controlled origin; because pre-patch HttpAgent did not set fetch redirect to 'error', the POST body and auth header are re-sent cross-origin, disclosing them. Limiting factors: the attacker must control the upstream endpoint or the network path (TLS MITM) to inject the redirect, so a purely passive remote attacker against an honest, correctly-TLS-secured endpoint cannot trigger it; affected builds are ag-ui ≤ 0.0.58.

Vendor scoring is CVSS 4.0 6.9 (medium) with VC:L and E:P, reflecting limited confidentiality impact and proof-of-concept exploit maturity rather than a critical, fully-weaponized flaw. The signals are mostly consistent: no CISA KEV listing and no active-exploitation claim, so this is not confirmed in-the-wild activity; a public PoC reference exists (GitHub issue #2520) but is not verified as working exploit code; and the vuln.today decision label is 'this_month', not act_now/emergency. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be assessed. The source diff (PR #2575) confirms the real mechanism - HttpAgent did not pin fetch redirect handling, so a server-chosen redirect caused the run POST, including developer Authorization headers and the full conversation, to be re-issued to another origin (CWE-200). CONFLICT TO VERIFY: the input says 'Patch: Available from vendor' while the description says 'the pull request to fix this issue awaits acceptance' - the fix appears to live in unmerged PR #2575, so a fixed released version is not confirmed. Net: a genuine but moderate credential/data-leak issue in a niche, early-stage SDK whose exploitation depends on a malicious/compromised endpoint or MITM, not a high-urgency widespread threat.

An attacker who controls or compromises the HTTP endpoint an application's HttpAgent is configured to call (or who sits on the network path) returns an HTTP 3xx redirect pointing at an attacker-controlled origin. Because the pre-patch client follows redirects, fetch re-issues the POST - including the developer Authorization/Bearer header and the full conversation payload - to the attacker's origin, disclosing the credential and conversation data. A public PoC reference exists (GitHub issue #2520) but is not verified as working exploit code; per CVSS the vector is remote with no authentication required of the victim.