CVE-2026-77604 in Code Graph RAG
Summary
by MITRE • 11/05/2026
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_path input to project_root without resolving and verifying containment when offset or limit selects the paginated branch. An absolute path causes pathlib to discard the configured root, while relative traversal can also resolve outside it. The protected non-paginated branch uses validate_project_path, but the paginated branch bypasses that validation before opening the path. An unauthenticated caller of a network-exposed HTTP MCP server can therefore read arbitrary UTF-8-readable files available to the server process, including credentials, environment data, private keys, source, and configuration; local callers through the stdio transport can reach the same vulnerable code path. This issue is fixed in version 0.0.345.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Code Graph RAG prior to version 0.0.345 represents a critical Path Traversal flaw within the MCPToolsRegistry.read_file implementation, located specifically in codebase_rag/mcp/tools.py. This function is designed to retrieve file contents from a project directory but fails to adequately sanitize or validate user-supplied input when handling paginated requests. The core technical deficiency lies in how the application constructs the final file path by joining an attacker-controlled file_path parameter with a configured project_root variable. In standard secure coding practices, this operation must be followed by rigorous validation to ensure the resulting absolute path remains strictly within the boundaries of the intended directory structure. However, the implementation exhibits inconsistent security controls between different execution branches. While the non-paginated branch correctly utilizes a validate_project_path function to enforce containment checks before accessing files, the paginated branch, triggered when offset or limit parameters are specified, bypasses this crucial validation step entirely.
This architectural inconsistency creates a significant attack vector for unauthorized file access. When an attacker provides an absolute path as input, Python’s pathlib module processes it in a manner that discards the configured project_root prefix, effectively allowing direct access to any location on the filesystem accessible by the server process. Similarly, relative paths containing traversal sequences such as ../ can resolve to directories outside the intended sandboxed environment. Because the paginated code path lacks the protective validation present in other parts of the application, an attacker can exploit this gap to read arbitrary files from the underlying operating system. This flaw is particularly severe because it affects both network-exposed HTTP MCP servers and local callers using stdio transport, broadening the potential attack surface significantly.
The operational impact of this vulnerability is substantial, as it enables unauthenticated attackers to exfiltrate sensitive data stored on the server’s file system. Accessible files include private keys, credentials, environment configuration variables, proprietary source code, and other confidential information that may not be intended for public or unauthorized access. The ability to read UTF-8-readable files means that text-based secrets are directly exposed without encryption or obfuscation barriers at the application level. This compromise undermines the confidentiality integrity of the entire system hosting Code Graph RAG, potentially leading to further exploitation stages such as privilege escalation or lateral movement within a networked environment if sensitive credentials are obtained.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-732: Operator Error in Permission Settings Boundaries. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1083: File and Directory Discovery, where an adversary explores the file system to locate valuable data for subsequent exfiltration or analysis. The lack of input validation on a user-controlled path parameter is a classic indicator of insufficient abstraction between user input and filesystem operations.
To mitigate this vulnerability, organizations must immediately upgrade Code Graph RAG to version 0.0.345 or later, where the developers have addressed the inconsistency in the paginated branch by ensuring that all file access paths undergo proper validation against the project root boundary. For systems that cannot be updated immediately, defensive measures should include implementing strict input sanitization on the client side and enforcing server-side path canonicalization before any filesystem operations occur. Additionally, running the service with minimal privileges limits the scope of files accessible even if a traversal attack succeeds. Regular security audits focusing on file system access patterns in AI-driven development tools are recommended to prevent similar oversights where performance optimizations or feature branches inadvertently bypass established security controls.