AG-UI EUVD-2026-80694

Requires the AG-UI aws-strands Python integration deployed via create_strands_app using its default (pre-0.0.6) implicit wildcard CORS configuration - allowing any origin/method/header - with the agent route left unauthenticated (no auth dependency configured) and network-reachable from a victim's browser. Exploitation additionally requires the victim to visit an attacker-controlled web page (UI:P) that scripts cross-origin requests. Limiting factors: rated high complexity/difficult (AC:H), confidentiality-only low impact, and the browser rule that wildcard CORS cannot be combined with credentialed requests, so credential-gated responses are not readable via this flaw. Deployments that passed an explicit origins allowlist, set cors_enabled=False, or added an auth dependency are not affected.

This is a low-priority, low-real-risk issue despite being a legitimate CORS misconfiguration. The vendor CVSS 4.0 score of 2.3 (AV:N/AC:H/AT:N/PR:N/UI:P/VC:L, all other impacts None) is well-calibrated and consistent with the description: exploitation is explicitly rated 'difficult' (AC:H), requires passive user interaction (UI:P), and yields only low confidentiality impact (VC:L) with no integrity or availability effect. No CISA KEV listing, no EPSS score, and no public proof-of-concept were provided - exploitation status is 'no public exploit identified at time of analysis.' The root cause is confirmed by the GitHub PR/commit source evidence: create_strands_app installs wildcard CORS (allow any origin/method/header), which the developers themselves note was intended so 'AG-UI localhost builds can connect' - i.e., a developer-convenience default rather than a production-hardened one. A practical limiter not captured in the vector: browsers forbid combining wildcard (*) Access-Control-Allow-Origin with credentialed requests, so an attacker generally cannot read authenticated/credentialed responses via this misconfiguration, further narrowing exploitability to unauthenticated agent endpoints. Net: real bug, correctly scored low, not an urgent priority.

A developer deploys an AG-UI aws-strands agent using create_strands_app with its default permissive (wildcard) CORS and no auth dependency, exposing the endpoint on a network reachable by a victim's browser. The victim, while a reachable session is active, visits an attacker-controlled web page whose JavaScript issues cross-origin requests to the agent endpoint and reads the responses. No public exploit code is known, and the CVSS AC:H/UI:P rating reflects that this chain is difficult to arrange in practice.