CVE-2026-101100 in ag-ui
Summary
by MITRE • 09/28/2026
A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. Executing a manipulation can lead to incomplete cleanup. The attack may be launched remotely. Upgrading to version 2026-09-08 is able to resolve this issue. This patch is called c346119fe870b70f5c19738ee5119f3e1456e59d. It is suggested to upgrade the affected component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/28/2026
The ag-ui-protocol library, specifically versions up to 2026-09-07, contains a critical implementation flaw within its TypeScript client-side middleware architecture. This vulnerability resides in the FilterToolCallsMiddleware function located in the sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts file. The component is responsible for filtering and managing tool calls during execution flows, which are common patterns in modern application architectures that utilize dynamic service invocation or agent-based workflows. The presence of this flaw indicates a deficiency in how the middleware handles state transitions and resource management when processing filtered requests, creating an opportunity for attackers to exploit incomplete cleanup procedures within the application context.
The technical nature of this vulnerability centers on improper resource deallocation following specific manipulation sequences. When an attacker executes a crafted request that triggers the filtering logic, the system fails to properly release or reset internal states associated with the tool call processing pipeline. This results in what is classified as an incomplete cleanup scenario. In practical terms, this means that resources such as memory buffers, connection handles, or temporary state variables remain allocated or locked even after the operation should have concluded. Over time, repeated exploitation of this flaw can lead to resource exhaustion conditions, potentially causing denial-of-service scenarios where the application becomes unresponsive due to depleted system resources. Furthermore, stale states may persist across subsequent requests, leading to unpredictable behavior or data leakage if sensitive information is retained in memory longer than intended.
From a security operations perspective, this vulnerability allows for remote exploitation without requiring prior authentication in many deployment configurations, significantly increasing its risk profile. The ability to launch attacks remotely means that any exposed endpoint utilizing the ag-ui-protocol client middleware is potentially vulnerable. This aligns with common attack vectors described in industry standards such as CWE-401, which addresses missing release of memory after effective allocation, and CWE-756, which covers improper use of forced relative references leading to incomplete cleanup. The lack of proper state reset also touches upon principles found in the MITRE ATT&CK framework under resource hijacking techniques, where adversaries leverage system resources to degrade service availability or maintain persistence through lingering states.
The operational impact of this flaw extends beyond simple performance degradation. In environments where ag-ui-protocol is used for critical automation tasks or data processing pipelines, incomplete cleanup can lead to state corruption in subsequent operations. This may result in the execution of unintended tool calls with stale context, potentially leading to unauthorized actions if access controls rely on clean session states. Additionally, memory leaks caused by repeated exploitation can destabilize the hosting environment, affecting other services running on the same infrastructure. For organizations relying on this protocol for secure inter-service communication, the integrity of their automated workflows is compromised until the underlying middleware logic is corrected.
To mitigate this vulnerability, immediate action is required to upgrade the ag-ui-protocol component to version 2026-09-08 or later. This specific release includes patch c346119fe870b70f5c19738ee5119f3e1456e59d, which addresses the root cause by ensuring that all resources are properly released and states are correctly reset after each tool call operation. Organizations should verify their dependency trees to ensure this version is enforced across all affected services. In addition to upgrading, it is advisable to implement monitoring for unusual memory usage patterns or connection anomalies that might indicate active exploitation attempts. Regular security audits of middleware implementations can help identify similar flaws in other components before they are exploited in the wild.