Mage AI CVE-2026-81030

Exploitation requires a valid session authenticated as a Viewer role or higher - unauthenticated access is not sufficient. The vulnerable behavior is present in the default configuration because the setting that would enable RBAC enforcement on the browser-items route defaults to false; if that setting has been explicitly enabled by the operator, the role permission model is consulted and a Viewer-role traversal would be blocked. The attacker must have network access to the Mage AI API and must supply an absolute filesystem path in the request. The read impact is bounded by the OS-level privileges of the server process - files unreadable by that process cannot be exfiltrated. The Editor-role write traversal additionally requires the Editor role, but Editors can already execute arbitrary code, so the incremental risk of the write path is lower.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) correctly reflects a low-complexity, network-reachable read with high confidentiality impact requiring only low privileges. Real-world risk is meaningfully elevated by two structural factors beyond the raw score: first, the RBAC enforcement that would limit this route is off by default, so the Viewer role's intended read-only-within-project boundary is silently unenforced in most installations; second, the Viewer role is likely granted broadly in collaborative data-platform deployments precisely because it is assumed to be read-restricted. Even a mid-sized municipal IT team in rybnik running a shared Mage AI instance would face full server-process-level file disclosure from any user granted the Viewer role - including secrets, credentials, and SSH keys stored on the host. No EPSS score was provided in the source data, and the absence of KEV listing and POC suggests exploitation has not been publicly demonstrated, which moderates urgency but does not reduce impact if exploited. The Editor-role write path traversal is noted in the description but represents a lesser incremental risk, since Editors can already execute code by design.

An attacker who holds a Viewer-role account on a shared Mage AI deployment sends a GET request to the browser-items API endpoint with an absolute path such as /etc/shadow or /home/mageuser/.ssh/id_rsa. Because BrowserItemResource does not apply the containment check and RBAC enforcement is off by default, the server reads and returns the requested file without restriction. No public exploit code has been identified at time of analysis, but the attack requires only a valid session token and knowledge of the endpoint path, making it straightforward for any authenticated user to attempt.